CVE-2026-120813
Plaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsing
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.
| CWE | CWE-436 |
| Vendor | mongodb |
| Product | mongodb server |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb mongodb server
Be the first to know when new medium vulnerabilities affecting mongodb mongodb server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
MongoDB / MongoDB Server
9.0.0 < 9.0.7 8.3.0 < 8.3.16 8.0.0 < 8.0.37 7.0.0 < 7.0.48