The vulnerability is caused by CRLF injection in Google Cloud Platform key identifier strings used by MongoDB's libmongocrypt library. An attacker with key‑vault write access can inject CRLF characters that terminate a legitimate header and add arbitrary headers, allowing a client with authorized encryption privileges to construct arbitrary GCP KMS API calls under the client's identity. This misleads the client into performing any KMS operation the authorized user is allowed to execute, effectively bypassing the boundary between database access and cloud key control. The weakness is a CRLF injection flaw, CWE-93.

MongoDB's libmongocrypt component, which provides client‑side encryption in MongoDB server and drivers. Any deployment that uses libmongocrypt with GCP KMS integration and exposes key‑vault write permissions is potentially affected. Specific affected versions are not listed in the data.

The CVSS score of 5.7 indicates moderate risk. EPSS data is not available and the vulnerability is not in the CISA KEV catalog. Exploitation requires the attacker to possess write access to the key vault and to run an authorized client that performs database operations. The attack vector is likely a legitimate client session that stores a malicious key identifier; the client later uses that key to send forged KMS requests under the authorized user's identity.