Bug 2563229 (CVE-2026-116641)

Summary: CVE-2026-116641 github.com/mongodb/mongo-tools: mongo-tools: Information disclosure via improper certificate validation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, aoconnor, bniver, flucifre, gmeno, groman, mbenjamin, mhackett, sostapov, vereddy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in mongo-tools. The application fails to reject connections using certificates issued by distrusted Certificate Authorities (CAs) due to an incomplete internal certificate denylist. A remote attacker in an intercepted network position could exploit this flaw by presenting a fraudulent certificate, enabling them to intercept and alter encrypted Transport Layer Security (TLS) traffic, resulting in information disclosure and data tampering.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-28 22:03:24 UTC 
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list.




DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check.




The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0