Bug 2528088 (CVE-2026-84962)
| Summary: | CVE-2026-84962 MONGOCRYPT: MONGOCRYPT: Privilege escalation due to KMS request forgery | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in MONGOCRYPT. An unauthorized user with key vault write access could exploit this vulnerability to cause an authorized client to issue arbitrary authenticated Google Cloud KMS (Key Management Service) API calls. This could lead to privilege escalation, allowing the unauthorized user to gain elevated database-level access into cloud key control and defeat client-side encryption.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2542410, 2542411, 2542412, 2542413, 2542414, 2542415, 2542416 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-09-03 15:32:15 UTC
|