{"id":"CVE-2026-114653","kind":"vulnerability","aliases":["CVE-2026-114653"],"related":[],"title":"MongoDB C# Driver: field-level encryption can silently store data in cleartext","description":"A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.","summary":"The MongoDB C# Driver's client-side encryption schema builder treats caller-supplied field names as pattern expressions without validating them. Fields meant to be encrypted can end up stored and returned in cleartext, so anyone with read access to the stored data can see them without the keys.","severity":"high","cvss":7.1,"epss":0.00214,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["client-side-encryption","csharp","dotnet","mongodb","package"],"not_affected_if":["no-client-side-encryption","other-language-driver"],"how_to_check":"- Check the installed MongoDB.Driver package version in the project's lock file or `dotnet list package`\n- Look for client-side field-level encryption schemas built with the C# driver, and check whether any field names contain pattern characters\n- Check whether protected fields come back in cleartext when read with the keys absent","fix":"- Upgrade the MongoDB C# Driver (MongoDB.Driver) to a fixed version; the fixed version number is unknown from the sources\n- Until fixed, verify encrypted fields in the stored data directly","status":"open","published_at":"2026-10-22T19:17:39+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:31:30+00:00","updated_at":"2026-10-25T03:31:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the MongoDB C# Driver (MongoDB.Driver) to a fixed version; the fixed version number is unknown from the sources\n- Until fixed, verify encrypted fields in the stored data directly","reach":"unknown","title":"MongoDB C# Driver: field-level encryption can silently store data in cleartext","impact":"medium","summary":"The MongoDB C# Driver's client-side encryption schema builder treats caller-supplied field names as pattern expressions without validating them. Fields meant to be encrypted can end up stored and returned in cleartext, so anyone with read access to the stored data can see them without the keys.","category":"package","nicknames":[],"who_cares":["csharp","dotnet","mongodb","client-side-encryption"],"confidence":0.6,"needs_auth":"no","worst_case":"Protected fields are stored and returned in cleartext to anyone with read access","analyst_note":"Find the affected and fixed MongoDB.Driver versions at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114653) and the MongoDB advisory it links to.","how_to_check":"- Check the installed MongoDB.Driver package version in the project's lock file or `dotnet list package`\n- Look for client-side field-level encryption schemas built with the C# driver, and check whether any field names contain pattern characters\n- Check whether protected fields come back in cleartext when read with the keys absent","needs_analyst":true,"not_affected_if":["no-client-side-encryption","other-language-driver"],"who_is_affected":"Applications using the MongoDB C# Driver with client-side field-level encryption that designate fields by name in the encryption schema. The problem depends on the field identifiers the application supplies, so teams that do not use client-side encryption in the C# driver can skip it. The sources do not say which driver versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":3440,"output_tokens":677,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114653':16A,19A '-2026':15A,18A 'access':68B,174C 'action':161C 'anyon':65B 'appli':137C,154C 'applic':117C 'broad':156C 'builder':38B 'c':2A,30B,90C 'caller':41B,94C 'caller-suppli':40B,93C 'caus':165C 'certain':120C 'cleartext':13A,63B,149C 'client':21B,34B,81C,124C 'client-sid':33B,80C,123C 'client-side-encrypt':20B 'compon':86C 'condit':167C 'construct':85C 'convers':150C 'csharp':24B 'cve':14A,17A 'data':11A,72B,139C,178C 'design':119C 'dotnet':25B 'driver':3A,31B,91C 'encrypt':7A,23B,36B,55B,83C,129C,143C,183C 'end':57B 'express':47B,107C 'fail':135C 'field':5A,43B,51B,96C,121C,127C 'field-level':4A,126C 'identifi':97C 'intend':140C,158C 'interpret':103C 'key':78B,184C 'level':6A,128C 'may':130C,153C 'meant':52B 'mongodb':1A,26B,29B,89C 'name':44B 'normal':109C 'observ':186C 'ordinari':172C 'packag':27B 'parti':170C 'pattern':46B,106C 'place':92C 'posit':100C 'possess':180C 'protect':133C 'read':67B,173C 'requir':163C 'result':115C 'return':61B,147C 'rule':152C 'schema':37B,84C 'see':74B 'side':22B,35B,82C,125C 'silent':9A,134C 'store':10A,59B,71B,145C,177C 'suppli':42B,95C 'treat':39B 'unprotect':188C 'user':160C 'valid':49B,111C 'valu':189C 'without':48B,76B,108C,179C","nicknames":[],"mitigations":[],"who_affected":"Applications using the MongoDB C# Driver with client-side field-level encryption that designate fields by name in the encryption schema. The problem depends on the field identifiers the application supplies, so teams that do not use client-side encryption in the C# driver can skip it. The sources do not say which driver versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114653","severity":null,"published_at":"2026-10-22T19:17:39+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114653","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114653","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}