CVE-2026-120813
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
66/100
Published: 2026-11-10
Modified: 2026-11-10
First seen: 2026-11-10
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
X
AT:
Present
VC:
High
VI:
None
VA:
None
Description
An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| MongoDB | MongoDB Server | 9.0.0 < 9.0.7 |
| MongoDB | MongoDB Server | 8.3.0 < 8.3.16 |
| MongoDB | MongoDB Server | 8.0.0 < 8.0.37 |
| MongoDB | MongoDB Server | 7.0.0 < 7.0.48 |