Security readout for executives and security teams
Plain-English summary
MongoDB Compass 1.38.0 can execute arbitrary shell commands when a user imports a malicious connection and initiates its OIDC sign-in flow. The imported connection can override a normally restricted browser-opening setting. Successful exploitation could compromise the user’s workstation and data accessible through that account.
Executive priority
Treat this as a high-priority endpoint remediation issue, especially for database administrators and other privileged users. Rapidly identify Compass 1.38.0, restrict untrusted connection imports, and follow MongoDB’s upgrade guidance. There is no supplied evidence of active exploitation, so emergency incident response is not warranted without additional indicators.
Technical view
The connection importer accepts a custom OIDC browser-open command that the normal connection form does not expose. When the user connects through OIDC, Compass may pass this attacker-controlled value to the operating system shell, creating a CWE-78 command-injection condition. The CVSS 4.0 score is 8.4; exploitation is local and requires active user interaction.
Likely exposure
Evidence specifically identifies MongoDB Compass 1.38.0. Risk is concentrated on workstations where users import connection definitions from untrusted or insufficiently verified sources and then use OIDC authentication. The supplied record does not establish exposure for other versions, server-side MongoDB products, or unattended systems.
Exploitation context
No CISA KEV listing or supplied source reports active exploitation. An attacker must persuade a user to import a crafted connection and actively connect using OIDC. Although interaction is required, successful exploitation could affect confidentiality, integrity, and availability on the user’s workstation.
Researcher notes
The record maps the issue to CWE-78 and assigns CVSS 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A with high local confidentiality, integrity, and availability impact. The supplied affected data names only version 1.38.0 and defaults other versions to unaffected. The release reference alone does not conclusively document the precise fixed-version boundary.
Mitigation direction
- Identify installations of MongoDB Compass 1.38.0 and prioritize systems used by administrators or privileged database users.
- Do not import Compass connection files from untrusted or unverifiable sources.
- Review MongoDB’s release guidance for the corrected version and upgrade accordingly.
- Until remediated, avoid OIDC connections created through imported configurations.
Validation and detection
- Inventory MongoDB Compass versions across managed workstations and confirm whether version 1.38.0 is present.
- Determine whether affected users import connection definitions and use OIDC authentication.
- Inspect imported connection configurations for unexpected browser-open command overrides.
- After upgrading, confirm the installed version matches MongoDB’s current security guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-14881 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——mongodbCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9mongodbVulnerability scoring details
Base CVSS 4.0 score
8.4HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/mongodb-js/compass/releases/tag/v1.49.7CVE reference, mongodb
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.