The MongoDB C# Driver contains a flaw in its client‑side encryption schema builder where caller‑supplied field identifiers are inserted directly into a regular‑expression position without validation or escaping. This causes the encryption rule to silently fail or apply incorrectly, resulting in data that was intended to be encrypted being stored and returned in cleartext, or the rule covering more fields than intended. The weakness is a form of data confidentiality loss.

MongoDB C# Driver is affected; specific version information is not disclosed in the CVE data, so all releases prior to the fix are potentially impacted.

The CVSS score is 7.1, indicating moderate to high severity. The EPSS score is not available, but the vulnerability can be triggered automatically during normal operation of an application using the driver; no special user action is required. Because an attacker only needs ordinary read access to the database, any user that can read the data can see unencrypted values. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an application that improperly specifies encrypted field names, which causes the server to store the data in cleartext without the caller’s knowledge.