# CVE-2026-14881: Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

> CVE-2026-14881: Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow. CVSS 7.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-14881
Last updated: 2026-10-24T13:10:00Z

- Published: 2026-07-22 19:23 UTC · Updated: 2026-10-24 13:10 UTC · Assigner: mongodb
- CVSS: 7.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS: 0.21%, 12th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-78

## Description

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

## Affected vendors and products

- MongoDB: MongoDB Compass

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-14881)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-14881)
- [https://github.com/mongodb-js/compass/releases/tag/v1.49.7](https://github.com/mongodb-js/compass/releases/tag/v1.49.7)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-14881 · Markdown: https://rewindex.com/cve/CVE-2026-14881.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-14881 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:06:18.704Z