CVE-2026-126817

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126817", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "state": "PUBLISHED", "assignerShortName": "mongodb", "dateReserved": "2026-11-11T20:06:23.925Z", "datePublished": "2026-11-13T15:40:10.838Z", "dateUpdated": "2026-11-13T15:40:10.838Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2026-11-13T15:40:10.838Z"}, "title": "Mongoid stores encrypted fields in plaintext when two models share a collection", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information", "type": "CWE"}]}], "affected": [{"vendor": "MongoDB", "product": "Ruby Driver", "versions": [{"status": "affected", "version": "9.0.0", "versionType": "semver"}, {"status": "affected", "version": "9.0.1", "versionType": "semver"}, {"status": "affected", "version": "9.0.2", "versionType": "semver"}, {"status": "affected", "version": "9.0.3", "versionType": "semver"}, {"status": "affected", "version": "9.0.4", "versionType": "semver"}, {"status": "affected", "version": "9.0.5", "versionType": "semver"}, {"status": "affected", "version": "9.0.6", "versionType": "semver"}, {"status": "affected", "version": "9.0.7", "versionType": "semver"}, {"status": "affected", "version": "9.0.8", "versionType": "semver"}, {"status": "affected", "version": "9.0.9", "versionType": "semver"}, {"status": "affected", "version": "9.0.10", "versionType": "semver"}, {"status": "affected", "version": "9.0.11", "versionType": "semver"}, {"status": "affected", "version": "9.0.12", "versionType": "semver"}, {"status": "affected", "version": "9.1.0", "versionType": "semver"}, {"status": "affected", "version": "9.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form."}]}], "references": [{"url": "https://jira.mongodb.org/browse/MONGOID-6037"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{}

{}

{}