# CVE-2026-115929: MongoDB Compass TLS certificate validation bypass in Electron

Source: https://junglewise.ai/threats/cve-2026-115929-mongodb-compass-relies-on-electron-a-third-party-runtime-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-24. Updated: 2026-10-24  
License: CC BY 4.0 with a link back

CVE-2026-115929 · Severity: medium · CVSS 6.8 · Published 2026-10-24

MongoDB Compass is a graphical user interface for managing MongoDB databases. The application relies on Electron, which contains compromised eMudhra intermediate CA certificates that allow attackers to forge HTTPS certificates. An attacker intercepting a user's network connection could impersonate websites and read or modify sensitive database traffic.

Technologies: [MongoDB Compass](https://junglewise.ai/threats/technologies/compass). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-115929 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115929 being exploited in the wild.

**How severe is CVE-2026-115929?** Medium severity, with a CVSS score of 6.8, published 24 October 2026.

**Which products and versions are affected?** MongoDB Compass before 1.53.1.

**Is there a fix for CVE-2026-115929?** Yes: fixed in Compass 1.53.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115929 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-115929?** Check whether you run MongoDB Compass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Compass 1.53.1

## Technical details

Electron's bundled TLS root certificate store includes recovered eMudhra intermediate certificates whose private keys were compromised, allowing arbitrary HTTPS certificate forging. An attacker with network-level access (adjacent network or internet interception) could perform man-in-the-middle attacks on Compass connections. The vulnerability is resolved by upgrading to Compass 1.53.1, which includes patched Electron 44.9.1.

## Affected products

- MongoDB Compass before 1.53.1

## Timeline

- 2026-10-20: disclosed
- 2026-10-23: patched

## References

- [https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/)
- [https://github.com/mongodb-js/compass/releases/tag/v1.53.1](https://github.com/mongodb-js/compass/releases/tag/v1.53.1)

## Related threats

- [MongoDB Compass code execution in BSON value escaping](https://junglewise.ai/threats/cve-2026-113870-mongodb-compass-improperly-escapes-certain-bson-values-when)
- [MongoDB Compass code injection via unescaped database name](https://junglewise.ai/threats/cve-2026-96750-mongodb-compass-can-interpolate-a-database-name-without-escaping)
- [MongoDB Compass OS command injection via connection import](https://junglewise.ai/threats/cve-2026-14881-mongodb-compass-os-command-injection-via-connection-import)
- [MongoDB Compass prototype pollution in CSV import](https://junglewise.ai/threats/cve-2026-9101-mongodb-compass-prototype-pollution-in-csv-import)
- [MongoDB Compass code injection in EJSON shell parser](https://junglewise.ai/threats/cve-2024-6376-mongodb-compass-code-injection-in-ejson-shell-parser)