CVE-2026-84962: mongodb libmongocrypt CRLF Injection
CVSS: 5.7v4.0MediumAnalyzed
AliasesUBUNTU-CVE-2026-84962DEBIAN-CVE-2026-84962
Published 03-09-2026Last modified 03-09-2026
Vulnerability summary
CVE-2026-84962 is a medium (CVSS 5.7) CRLF Injection vulnerability in mongodb libmongocrypt. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.6% of scored vulnerabilities.
CVSS score
5.7/10
010
Medium · v4.0 (CVE.org)EPSS score
0.18%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 03-09-2026PublishedVulnerability first disclosed.
- 03-09-2026Last modifiedVulnerability information updated.
Description
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
CVSS metrics
7 scores · 4 sources · 2 versionsMedium 5.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated5.7MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated5.7MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST5.7MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 4.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
- NVDNIST4.2MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
+0.07 pp
From 0.12% on 19-09-2026
19-09-202619-10-2026
EPSS score0.18%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libmongocryptAll versions (No fix recorded) | < 1.20.2-1
Mongodb1 product
- libmongocrypt< 1.20.2
Ubuntu1 product
- libmongocryptAll versions (No fix recorded)
3 vendors · 3 products
