CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...

CVE-2026-114649

The MongoDB C# Driver is vulnerable to an authentication bypass due to insufficient certificate validation when managing cached connections. The driver incorrectly compares TLS client certificates using only the issuer and serial number . An attacker can provide a certificate mimicking another us...