CVE-2026-84962CWE-93

CVE-2026-84962

Medium · published September 3, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
5.7 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-09-03T20:18Z
Affected products (1)
ProductVersionsFixed in
mongodb/libmongocrypt< 1.20.21.20.2
References (1)
https://jira.mongodb.org/browse/MONGOCRYPT-960 · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 15:03Z
    Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
    cvelistv5