CVE-2026-14881: MongoDB Compass Auth Bypass Vulnerability

CVE-2026-14881 Overview

CVE-2026-14881 affects MongoDB Compass, the graphical client for MongoDB databases. The vulnerability allows an attacker to override protected connection options when a user imports a malicious connection file. Specifically, the import functionality accepts a custom browser open command used during the OpenID Connect (OIDC) authentication flow. This command is normally restricted to global Compass settings and cannot be modified through the connection form. An attacker who convinces a user to import a crafted connection can execute arbitrary OS commands on the local system. The issue is tracked under CWE-78 (OS Command Injection).

Critical Impact
A crafted connection import triggers arbitrary command execution on the victim host during the OIDC authentication flow, leading to full confidentiality, integrity, and availability compromise of the user session.

Affected Products

MongoDB Compass versions prior to v1.49.7
MongoDB Compass desktop client on Windows, macOS, and Linux
Any Compass distribution using the OIDC authentication flow

Discovery Timeline

2026-07-22 - CVE-2026-14881 published to NVD
2026-07-22 - Last updated in NVD database
Patch released - MongoDB Compass v1.49.7 addresses the issue

Technical Details for CVE-2026-14881

Vulnerability Analysis

MongoDB Compass exposes an import feature that reads connection definitions from external files. During import, Compass fails to enforce the same restrictions that apply to the connection form UI. Options intended to be configurable only through global settings can be supplied inside the imported connection payload. One of these options is the browser open command used to launch the system browser for the OIDC authorization step. When Compass initiates OIDC authentication for that connection, it invokes the attacker-controlled command string, resulting in local command execution under the privileges of the Compass user.

Root Cause

The root cause is missing input validation and privilege separation between two configuration surfaces. The connection form intentionally restricts sensitive fields such as the OIDC browser command. The import routine does not apply the same allowlist, so untrusted connection files can carry fields that the UI would reject. This is a classic OS Command Injection pattern [CWE-78], where user-supplied data reaches a command execution sink without sanitization.

Attack Vector

Exploitation requires local user interaction. The attacker crafts a connection file containing a malicious browserCommandForOIDCAuth value. The victim imports the file into Compass and initiates a connection that uses the OIDC authentication flow. Compass spawns the attacker-supplied command instead of a legitimate browser launcher. Because the flow runs in the context of the interactive user, the attacker inherits that user's file system access, tokens, and network reachability. See the MongoDB Compass v1.49.7 release notes for technical details on the fix.

Detection Methods for CVE-2026-14881

Indicators of Compromise

Unexpected child processes spawned by the Compass executable (for example MongoDBCompass.exe launching cmd.exe, powershell.exe, bash, or sh).
Compass connection files (.json) received via email, chat, or shared drives containing a browserCommandForOIDCAuth field.
Outbound network connections initiated by child processes of Compass to non-browser destinations.

Detection Strategies

Monitor process ancestry for Compass spawning shells or scripting interpreters, which is not expected behavior for the OIDC flow.
Inspect imported connection files for the presence of fields normally restricted to global settings, particularly OIDC browser command overrides.
Alert on Compass writing or reading files outside of its standard user data directory following an import event.

Monitoring Recommendations

Collect endpoint process telemetry with command-line arguments to catch injected commands executed through Compass.
Log file transfers of .json connection exports across email gateways and collaboration platforms.
Correlate Compass launch events with subsequent authentication and shell activity on the same host.

How to Mitigate CVE-2026-14881

Immediate Actions Required

Upgrade MongoDB Compass to v1.49.7 or later on all workstations.
Instruct users not to import connection files from untrusted or unverified sources.
Audit existing saved connections for suspicious browserCommandForOIDCAuth values and remove them.

Patch Information

MongoDB released the fix in Compass v1.49.7. The release restricts which connection options can be overridden through the import path, aligning it with the connection form allowlist. Download the patched build from the MongoDB Compass v1.49.7 release page.

Workarounds

Block distribution of Compass connection export files through email and collaboration tools until all endpoints are patched.
Restrict Compass usage to managed workstations where application allowlisting prevents unexpected child processes.
Require users to configure connections manually through the UI rather than through imports where feasible.

bash

# Verify the installed Compass version on macOS or Linux
mongodb-compass --version

# Example allowlisting check: list child processes of Compass
ps -ef | grep -i compass