MongoDB Shell (mongosh) relies on Node.js as a third-party runtime with its own TLS root certificate store. The store contains recoverable eMudhra intermediate CA certificates. Because these certificates are trusted, any server presenting a certificate chain through these intermediates would be accepted without verification. Based on the description, it is inferred that an attacker could execute a man‑in‑the‑middle or impersonation attack, enabling interception or substitution of MongoDB traffic and thereby compromising confidentiality, integrity, and availability.

All installations of MongoDB Shell (mongosh) older than version 2.14.0 are affected. If mongosh is installed via npm, the host’s Node.js runtime also contains the vulnerable certificate store; updating that runtime separately is required. Therefore, any system running mongosh 2.13.x or earlier, or running an older Node.js version when installed through npm, must be reviewed.

The CVSS score of 7.6 indicates high severity. EPSS information is not available, so the probability of exploitation cannot be quantified at this time. Because the attack can be carried out remotely by an entity that controls a TLS server with a certificate chain that includes the compromised eMudhra intermediates, the attack vector is likely network-based. Based on the description, it is inferred that the risk is primarily to clients that use mongosh to connect to MongoDB instances. The attacker would need to establish a TLS session presenting a chain linked to the disallowed CA, which is feasible with a compromised or malicious certificate authority. Overall, the risk is moderate to high for systems running older mongosh versions or an unpatched Node.js runtime.