CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

🗓️ 22 Jul 2026 19:23:17Reported by GoogleType

osv🔗 osv.dev👁 2 Views

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usua...

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-14881	22 Jul 202619:23	–	attackerkb
Circl	CVE-2026-14881	22 Jul 202620:55	–	circl
CVE	CVE-2026-14881	22 Jul 202619:23	–	cve
Cvelist	CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow	22 Jul 202619:23	–	cvelist
EUVD	EUVD-2026-47781	22 Jul 202619:23	–	euvd
NVD	CVE-2026-14881	22 Jul 202620:16	–	nvd
Positive Technologies	PT-2026-63483	22 Jul 202600:00	–	ptsecurity

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14881.json
github	www.github.com/mongodb-js/compass/releases/tag/v1.49.7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-14881

23 Jul 2026 04:07Current

5.3Medium risk

Vulners AI Score5.3

CVSS 48.4