CVE-2026-84962
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
- Record
CVE-2026-84962- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
EUVDEUVD-2026-70516
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
- Record
EUVD-2026-70516- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
- Record
CVE-2026-84962- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSV
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
- Record
CVE-2026-84962- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-84962
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
- Record
DEBIAN-CVE-2026-84962- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-84962
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
- Record
UBUNTU-CVE-2026-84962- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmongocryptDebian:12 |
All versions, plus listed versions 1.10.0-11.10.1-11.11.0-11.12.0-11.13.0-1 Show 18 moreShow less1.13.1-11.13.2-11.16.0-11.17.0-11.17.3-11.18.1-11.18.2-11.19.0-11.19.1-11.20.0-11.20.1-11.20.2-11.20.3-11.20.4-11.7.2-11.8.2-11.8.4-11.9.1-1 |
None known |
libmongocryptDebian:13 |
All versions, plus listed versions 1.13.2-11.13.2-1+deb13u11.16.0-11.17.0-11.17.3-1 Show 9 moreShow less1.18.1-11.18.2-11.19.0-11.19.1-11.20.0-11.20.1-11.20.2-11.20.3-11.20.4-1 |
None known |
libmongocryptDebian:14 |
before 1.20.2-1, plus listed versions 1.13.2-11.16.0-11.17.0-11.17.3-11.18.1-1 Show 5 moreShow less1.18.2-11.19.0-11.19.1-11.20.0-11.20.1-1 |
1.20.2-1 |
libmongocryptUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.1-11.2.2-11.3.0-11.3.0-1ubuntu1 |
None known |
libmongocryptUbuntu:24.04:LTS |
All versions, plus listed versions 1.7.2-11.8.2-11.8.4-11.8.4-1build21.8.4-1build3 |
None known |
libmongocryptUbuntu:26.04:LTS |
All versions, plus listed versions 1.13.2-11.17.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-84962 is a medium vulnerability (CVSS 5.7) in Mongodb Libmongocrypt, published September 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. Fixed in libmongocrypt 1.20.2-1.