CVE-2026-114655: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in MongoDB libmongocrypt

The vulnerability in libmongocrypt arises because it constructs requests to external key management services (AWS, Azure, GCP) by inserting values from key vault documents, KMS provider configurations, and KMS responses directly into request lines, headers, and signed request bodies without proper validation or encoding. This improper neutralization (CWE-74) allows a user with write access to the key vault collection to modify the structure of these requests, including adding members to request bodies and token claims. These manipulated requests are then signed with the application's credentials, potentially causing key management operations with unintended parameters. The issue affects versions >=1.0.0 and <1.21.1 of libmongocrypt. The CVSS 4.0 score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, and partial privileges required. A patch is available, and since libmongocrypt is used in cloud services, the vendor manages remediation for cloud-hosted services.

An attacker with write access to the key vault collection can manipulate requests sent to external key management services, potentially causing key management operations to be performed with parameters not intended by the application. This could lead to unauthorized key management actions, undermining the security of cryptographic operations relying on these keys.

A patch is available for libmongocrypt versions affected by this vulnerability. Users should upgrade to version 1.21.1 or later to remediate the issue. For cloud-hosted services using libmongocrypt, the vendor manages remediation server-side; users should consult the vendor advisory for confirmation and further guidance.