# CVE-2026-116641: The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

> CVE-2026-116641: The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs. CVSS 6.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-116641
Last updated: 2026-10-29T16:18:00Z

- Published: 2026-10-28 21:48 UTC · Updated: 2026-10-29 16:18 UTC · Assigner: mongodb
- CVSS: 6.8 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- EPSS: 0.14%, 4th percentile (scored 2026-11-03)
- CISA KEV: no
- CWE: CWE-295

## Description

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0

## Affected vendors and products

- MongoDB: Database Tools

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-116641)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-116641)
- [https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.20.0-changelog/](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.20.0-changelog/)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-116641 · Markdown: https://rewindex.com/cve/CVE-2026-116641.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-116641 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T11:02:18.530Z