CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An attacker with write access can inject CRLF into key identifiers to force authenticated KMS API calls, escalating privileges and bypassing client-side encryption.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-84962?
CVE-2026-84962 is a medium-severity vulnerability in MongoDB libmongocrypt, published on 3 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
Weakness: CWE-93
Which versions are affected by CVE-2026-84962?
It affects 1 product.
Products include Mongodb Libmongocrypt.
How do I fix CVE-2026-84962?
Apply the vendor's patch.
Is CVE-2026-84962 being exploited?
There is no known exploitation of CVE-2026-84962 in the wild and no public exploit code.
Other vulnerabilities in MongoDB libmongocrypt
- CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
- CVE-2026-84971 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
- CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
Sources
Also known as DEBIAN-CVE-2026-84962, UBUNTU-CVE-2026-84962.