Description
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality guarantee that client-side encryption is intended to provide. No integrity or availability impact was observed.
Published: 2026-10-22
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Plaintext exposure of encrypted fields
Action: Apply patch
AI Analysis

Impact

A flaw in client‑side encryption support for the MongoDB .NET/C# driver can allow data that is intended to be encrypted to be written to the database in clear text. The issue arises when platform text‑encoding configurations corrupt an internal name conversion, causing the encryption layer to lose association with the configured encryption rules and silently proceed without raising an error. The result is that sensitive fields are persisted without confidentiality protection, while integrity and availability remain unaffected.

Affected Systems

The vulnerability affects the MongoDB C# Driver and the MongoDB.Libmongocrypt NuGet package. No specific version range is listed in the CNA data, but the references point to a fix in release v3.13.0.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely application dependent: an attacker who can write data through an impacted application may cause plain‑text persistence. The flaw is silent and does not trigger errors, making detection and exploitation tedious but feasible for an attacker with write access to the drug data.

Generated by OpenCVE AI on October 23, 2026 at 03:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the MongoDB .NET/C# driver to version 3.13.0 or later to apply the vendor patch.
  • If an upgrade is not immediately feasible, restrict or remove write permissions for the application components that handle sensitive user data so that plaintext writes cannot originate from those pathways.
  • Validate that client‑side encryption rules are correctly associated by testing writes to encrypted fields during development or staging before deploying changes to production.

Generated by OpenCVE AI on October 23, 2026 at 03:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb c# Driver
Mongodb mongodb.libmongocrypt Nuget Package
Vendors & Products Mongodb
Mongodb c# Driver
Mongodb mongodb.libmongocrypt Nuget Package

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality guarantee that client-side encryption is intended to provide. No integrity or availability impact was observed.
Title Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
Weaknesses CWE-838
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Mongodb C# Driver Mongodb.libmongocrypt Nuget Package
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-11-02T12:29:15.032Z

Reserved: 2026-10-21T21:57:49.528Z

Link: CVE-2026-114650

cve-icon Vulnrichment

Updated: 2026-11-02T12:28:42.460Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T19:17:38.837

Modified: 2026-11-02T13:17:36.333

Link: CVE-2026-114650

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T14:40:21Z

Weaknesses
  • CWE-838

    Inappropriate Encoding for Output Context