Configuration may unexpectedly disable certificate validation
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 0.2%
exploitation probability
0.2%top 94% of all CVEs
observed exploitation
nono source reports it
In short
The MongoDB Rust Driver disables certificate validation when a specific configuration setting is used, even though the setting's name suggests the opposite. This allows attackers to intercept encrypted connections without being detected.
Technical detail
CWE-295: Improper Certificate Validation. When tlsInsecure=False is configured in connection strings for MongoDB Rust Driver versions <3.2.5, SSL/TLS certificate validation is unexpectedly disabled, enabling man-in-the-middle attacks on database connections. The vulnerability stems from inverted logic in configuration parsing.
Summary generated and translated by AI from the official description.
When tlsInsecure=False appears in a connection string, certificate validation is disabled.
This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
MongoDB · Rust Driver