The MongoDB C# Driver’s client‑side encryption configuration stores sensitive key‑management credentials in its human‑readable client settings string without masking them, while other secret fields are masked. If an attacker can read the application’s logs, diagnostic output, or obtain a process memory dump, they may recover those plaintext credentials and use them to decrypt protected data. This flaw aligns with CWE‑532, representing inappropriate handling of sensitive information.

Affected systems are applications that use the MongoDB C# Driver, specifically the product listed as MongoDB C# Driver. Vulnerable versions include the NuGet package 3.11.1, and potentially any releases prior to the patch that addressed this serialization issue. To determine exact scope, review your deployment for versions 3.11.1 or earlier and apply an updated driver that contains the fix.

This vulnerability carries a CVSS score of 6.8, indicating medium severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires access to the host’s log files or memory; if the application logs or diagnostics are exposed to a non‑privileged user or attacker, the risk is elevated. The attacker would obtain the key‑management credentials and thus compromise any data encrypted by the driver, leading to confidentiality loss of sensitive fields.