The vulnerability arises because MongoDB Database Tools rely on Golang’s TLS stack. Golang’s crypto/x509 package contains a denylist of known-bad CA certificates, but versions before 1.27.3 did not include eMudhra certificates on that denylist. As a result, Database Tools built with older Golang versions will accept certificates issued by recoverable eMudhra intermediate CAs, allowing an attacker to present a forged certificate and intercept TLS traffic. The flaw can compromise confidentiality and integrity of data transferred by the tool, exposing sensitive database credentials and query results.

MongoDB Database Tools are affected. The 100.19.0 release uses Golang 1.26.8 and therefore lacks the eMudhra denial check. The issue is fixed in 100.20.0, which is compiled with Golang 1.27.3. Any installations of the tool built with Golang 1.26.x or earlier are vulnerable.

The CVSS base score is 7.6, indicating high severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation has not yet been widely documented. The attack requires an adversary to supply a TLS server with a certificate signed by an eMudhra CA; the tool will then trust the certificate and establish a session. This makes it a low-barrier, credentialless MITM attack against any system running the vulnerable tool when it communicates over TLS.