MongoDB Server, when running a sharded cluster with Queryable Encryption enabled, allows an authenticated user who has write rights on an encrypted collection to submit crafted write commands through the mongos router. The server incorrectly validates internal encryption metadata fields, which are intended to be immutable. An attacker can therefore alter these fields, leading to corruption of query correctness and potentially causing protected data to be returned incorrectly or accessed in unintended ways. The weakness is classified as CWE‑441, indicating a failure to properly validate internal data structures.

The vulnerability is confined to MongoDB Server instances that are part of a sharded cluster and have Queryable Encryption enabled. The only known affected vendor/product is MongoDB Server. No specific version numbers are listed in the available information, so all releases that support sharded Queryable Encryption are potentially vulnerable until a patch is applied.

The CVSS score of 7.1 demonstrates a high‑severity issue. However, the EPSS score of < 1% shows that the probability of exploitation is very low, and the vulnerability is not currently listed in CISA KEV, implying that a public exploit has not been observed. Attackers would need to be authenticated and possess write permissions on the target encrypted collection, limiting the vector to insider threats or accounts that have been compromised. While the risk to organizations that enable Queryable Encryption and grant broad write privileges is moderate to high, the overall likelihood of a real‑world compromise remains low under the present circumstances.