AIKIDO-2026-512471
mongodb.libmongocrypt is vulnerable to CRLF Injection
57
Medium Risk
This Affects:
mongodb.libmongocryptTL;DR
libmongocrypt builds Google Cloud KMS request lines and headers from key identifier fields (project, location, key ring, key name) stored in the key vault without neutralizing CR/LF characters. A key vault document containing CRLF sequences in these GCP key identifiers lets those bytes break out of the intended request and inject chosen request content, causing the authorized client to issue arbitrary authenticated GCP KMS API calls. This escalates key-vault write access into control over the tenant's cloud key management and can bypass client-side encryption protections. The fix rejects CR/LF characters in GCP key identifier strings.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use Google Cloud KMS for client-side field-level encryption and an untrusted party can write to the key vault collection.
Background info
mongodb.libmongocrypt is vulnerable to CRLF Injection in versions 1.1.0 - 1.20.1.
How to fix this
Upgrade the mongodb.libmongocrypt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.