Medium severity6.8NVD Advisory· Published Oct 24, 2026

CVE-2026-115929

Description

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

Affected products

MongoDB/Compassllm-fuzzy
Range: <1.53.1
Electron PDF/Electron PDFllm-fuzzy
Range: <44.9.1

Patches

Vulnerability mechanics

References

blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/nvd
github.com/mongodb-js/compass/releases/tag/v1.53.1nvd
releases.electronjs.org/release/v44.9.1nvd

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000