A flaw in MongoDB Server’s query analysis for the $vectorSearch aggregation stage used with Queryable Encryption or Client‑Side Field Level Encryption causes literal values of encrypted fields in filter expressions to be sent to the server as plaintext instead of ciphertext. This results in the cleartext disclosure of sensitive data that should be protected by encryption, representing a clear‑text transmission vulnerability (CWE‑319).

MongoDB Server is the affected product. The specific MongoDB Server versions that are vulnerable are not listed in the CVE data; administrators should consult MongoDB release notes or the referenced JIRA issue for detailed version information.

The escalation path requires an attacker to submit an aggregate query that includes encrypted fields in $vectorSearch. The CVSS score of 7.1 indicates a high severity risk, while the EPSS score is not provided, leaving the exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. Because the flaw leaks plaintext values to the server side, an attacker with query capability or network visibility can recover encrypted data, leading to potential data confidentiality loss. No public exploit is currently documented, but the weakness warrants immediate remediation.