# CVE-2026-84962: MongoDB Crypt key vault privilege escalation to Google Cloud KMS

Source: https://junglewise.ai/threats/cve-2026-84962-mongodb-crypt-key-vault-privilege-escalation-to-google-cloud-kms  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84962 · Severity: medium · CVSS 4.2 · Published 2026-09-03

MongoDB's client-side encryption library allows an attacker with write access to the key vault to trick legitimate applications into making unauthorized API calls to Google Cloud KMS under the legitimate user's credentials. This bypasses the application's own encryption protections and gives attackers control over the encryption keys that protect sensitive data.

Technologies: [MongoDB Libmongocrypt](https://junglewise.ai/threats/technologies/libmongocrypt). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-84962 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84962 being exploited in the wild.

**How severe is CVE-2026-84962?** Medium severity, with a CVSS score of 4.2, published 3 September 2026.

**Which products and versions are affected?** MongoDB mongocrypt.

**Is there a fix for CVE-2026-84962?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84962 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84962?** Check whether you run MongoDB Libmongocrypt or MongoDB Mongocrypt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in MongoDB's Crypt library (mongocrypt) and involves improper validation of key vault contents. An attacker with write access to the MongoDB key vault can inject or modify data that causes an authorized client application to issue arbitrary authenticated API calls to Google Cloud KMS using the client's own identity. This escalates limited database-level write access into cloud key management privileges. The attack requires the legitimate client to be already connected and authenticated to both MongoDB and Google Cloud KMS; the vulnerability is triggered when the client processes malicious data from the key vault. No patch status is currently documented in the available advisory information.

## Affected products

- MongoDB mongocrypt

## Timeline

- 2026-09-03: disclosed

## References

- [https://jira.mongodb.org/browse/MONGOCRYPT-960](https://jira.mongodb.org/browse/MONGOCRYPT-960)

## Related threats

- [libmongocrypt out-of-bounds write in key-management request builder](https://junglewise.ai/threats/cve-2026-126792-a-memory-safety-flaw-in-the-key-management-request-building)
- [libmongocrypt KMS request injection in key vault processing](https://junglewise.ai/threats/cve-2026-114655-libmongocrypt-builds-requests-to-external-key-management)
- [MongoDB libmongocrypt state management memory corruption](https://junglewise.ai/threats/cve-2026-106433-improper-state-management-in-mongodb-libmongocrypt-can-cause)
- [MongoDB libmongocrypt denial of service via undersized encrypted payload](https://junglewise.ai/threats/cve-2026-84971-mongodb-libmongocrypt-denial-of-service-via-undersized-encrypted)
- [MongoDB libmongocrypt input validation bypass in automatic encryption](https://junglewise.ai/threats/cve-2026-81523-mongodb-libmongocrypt-input-validation-bypass-in-automatic)