Vulnerability Details CVE-2026-14881
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 11.1%
CVSS Severity
CVSS v3 Score 7.8
Products affected by CVE-2026-14881
-
cpe:2.3:a:mongodb:compass:1.43.4
-
cpe:2.3:a:mongodb:compass:1.43.5
-
cpe:2.3:a:mongodb:compass:1.43.6
-
cpe:2.3:a:mongodb:compass:1.44.0
-
cpe:2.3:a:mongodb:compass:1.44.3
-
cpe:2.3:a:mongodb:compass:1.44.4
-
cpe:2.3:a:mongodb:compass:1.44.5
-
cpe:2.3:a:mongodb:compass:1.44.6
-
cpe:2.3:a:mongodb:compass:1.44.7
-
cpe:2.3:a:mongodb:compass:1.45.0
-
cpe:2.3:a:mongodb:compass:1.45.1
-
cpe:2.3:a:mongodb:compass:1.45.2
-
cpe:2.3:a:mongodb:compass:1.45.3
-
cpe:2.3:a:mongodb:compass:1.45.4
-
cpe:2.3:a:mongodb:compass:1.46.0
-
cpe:2.3:a:mongodb:compass:1.46.1
-
cpe:2.3:a:mongodb:compass:1.46.10
-
cpe:2.3:a:mongodb:compass:1.46.11
-
cpe:2.3:a:mongodb:compass:1.46.2
-
cpe:2.3:a:mongodb:compass:1.46.3
-
cpe:2.3:a:mongodb:compass:1.46.4
-
cpe:2.3:a:mongodb:compass:1.46.5
-
cpe:2.3:a:mongodb:compass:1.46.6
-
cpe:2.3:a:mongodb:compass:1.46.7
-
cpe:2.3:a:mongodb:compass:1.46.8
-
cpe:2.3:a:mongodb:compass:1.46.9
-
cpe:2.3:a:mongodb:compass:1.47.0
-
cpe:2.3:a:mongodb:compass:1.47.1
-
cpe:2.3:a:mongodb:compass:1.48.0
-
cpe:2.3:a:mongodb:compass:1.48.1
-
cpe:2.3:a:mongodb:compass:1.48.2
-
cpe:2.3:a:mongodb:compass:1.49.0
-
cpe:2.3:a:mongodb:compass:1.49.1
-
cpe:2.3:a:mongodb:compass:1.49.2
-
cpe:2.3:a:mongodb:compass:1.49.3
-
cpe:2.3:a:mongodb:compass:1.49.4
-
cpe:2.3:a:mongodb:compass:1.49.5
-
cpe:2.3:a:mongodb:compass:1.49.6