Description
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Published: 2026-09-17
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://jira.mongodb.org/browse/EF-388 cve-icon cve-icon
History

Thu, 17 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Description Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Title Combining encryption settings may disable encryption
Weaknesses CWE-311
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-09-17T20:02:17.860Z

Reserved: 2026-09-16T18:58:13.823Z

Link: CVE-2026-92756

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T20:18:57.160

Modified: 2026-09-17T20:18:57.160

Link: CVE-2026-92756

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-311

    Missing Encryption of Sensitive Data