CVE-2026-114655

A flaw was found in libmongocrypt, where the library constructs requests to external Key Management Service (KMS) providers without properly validating or encoding values sourced from key vault documents, provider configurations, or service responses. An attacker with write access to the key vault collection can manipulate request structures and inject arbitrary parameters or token claims that are signed using the application's credentials, potentially resulting in unauthorized key management operations with unintended parameters, information disclosure, or compromised cryptographic keys. All libmongocrypt versions >= 1.0.0 and < 1.21.1 are affected; the issue is fixed in 1.21.1. The vulnerable KMS request-construction code is core to the library, so all shipped in-range community versions (epel-8/9/10, fedora-43/44/rawhide) are affected and are handled as delegated community affects.