Live › vulnerability › CVE-2026-114653
Go to dashboardThe MongoDB C# Driver's client-side encryption schema builder treats caller-supplied field names as pattern expressions without validating them. Fields meant to be encrypted can end up stored and returned in cleartext, so anyone with read access to the stored data can see them without the keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications using the MongoDB C# Driver with client-side field-level encryption that designate fields by name in the encryption schema. The problem depends on the field identifiers the application supplies, so teams that do not use client-side encryption in the C# driver can skip it. The sources do not say which driver versions are affected.
No product ranges from the sources yet.
dotnet list packageEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.
This page as .md · .json · in your agent: get_signal("CVE-2026-114653")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.