CVE-2026-114655 KMS request injection via unsanitized key vault and provider values in libmongocrypt

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

CVE-2026-114655

libmongocrypt is vulnerable to a request injection flaw when interacting with external key management services, including AWS , Azure , and GCP . The issue stems from the library inserting values from key vault documents, KMS provider configurations, and KMS responses into request lines, headers,...