CVE-2026-126817
Mongoid stores encrypted fields in plaintext when two models share a collection
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.
| CWE | CWE-312 |
| Vendor | mongodb |
| Product | ruby driver |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb ruby driver
Be the first to know when new medium vulnerabilities affecting mongodb ruby driver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
MongoDB / Ruby Driver
9.0.0 9.0.1 9.0.2 9.0.3 9.0.4 9.0.5 9.0.6 9.0.7 9.0.8 9.0.9 9.0.10 9.0.11 9.0.12 9.1.0 9.1.1