# CVE-2025-11695: MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

Source: https://junglewise.ai/threats/cve-2025-11695-mongodb-rust-driver-has-certificate-validation-disabled-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-13  
License: CC BY 4.0 with a link back

CVE-2025-11695 · Severity: high · CVSS 8 · Published 2025-10-13

When tlsInsecure=False appears in a connection string, certificate validation is disabled.

This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5

Technologies: [mongodb (crates.io)](https://junglewise.ai/threats/technologies/crates-io-mongodb), [MongoDB Rust Driver](https://junglewise.ai/threats/technologies/rust-driver). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2025-11695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-11695 being exploited in the wild.

**How severe is CVE-2025-11695?** High severity, with a CVSS score of 8, published 13 October 2025.

**Which products and versions are affected?** mongodb (crates.io) SEMVER:introduced=0,fixed=3.2.5.

**Is there a fix for CVE-2025-11695?** Yes. mongodb (crates.io): upgrade to 3.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-11695?** Check whether you run mongodb (crates.io) or MongoDB Rust Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mongodb (crates.io): upgrade to 3.2.5 or later

  ```sh
  cargo update -p mongodb
  ```


## Affected products

- mongodb (crates.io) SEMVER:introduced=0,fixed=3.2.5
- MongoDB Rust Driver

## Identifiers

- CVE-2025-11695
- GHSA-3p6w-gv5g-xjw9

## Related threats

- [MongoDB Rust Driver credential disclosure in diagnostic output](https://junglewise.ai/threats/cve-2026-126838-a-mongodb-rust-driver-component-that-holds-client-side-field)
- [MongoDB Rust Driver information disclosure in diagnostic tracing](https://junglewise.ai/threats/cve-2026-120673-a-component-of-the-mongodb-rust-driver-that-records-diagnostic)
- [MongoDB Rust Driver GridFS query injection in file identifier matching](https://junglewise.ai/threats/cve-2026-88024-mongodb-rust-driver-gridfs-query-injection-in-file-identifier)
- [MongoDB Rust Driver injection in database/collection name](https://junglewise.ai/threats/cve-2026-81526-mongodb-rust-driver-injection-in-database-collection-name)
- [MongoDB Rust driver may issue unintended commands](https://junglewise.ai/threats/cve-2024-6382-mongodb-rust-driver-may-issue-unintended-commands)