---
id: "CVE-2026-114653"
kind: "vulnerability"
aliases: ["CVE-2026-114653"]
title: "MongoDB C# Driver: field-level encryption can silently store data in cleartext"
severity: "high"
cvss: 7.1
epss: 0.00214
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["client-side-encryption", "csharp", "dotnet", "mongodb", "package"]
not_affected_if: ["no-client-side-encryption", "other-language-driver"]
published_at: "2026-10-22T19:17:39+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:31:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114653", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114653", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# MongoDB C# Driver: field-level encryption can silently store data in cleartext

The MongoDB C# Driver's client-side encryption schema builder treats caller-supplied field names as pattern expressions without validating them. Fields meant to be encrypted can end up stored and returned in cleartext, so anyone with read access to the stored data can see them without the keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MongoDB.Driver package version in the project's lock file or `dotnet list package`
- Look for client-side field-level encryption schemas built with the C# driver, and check whether any field names contain pattern characters
- Check whether protected fields come back in cleartext when read with the keys absent

## Fix

- Upgrade the MongoDB C# Driver (MongoDB.Driver) to a fixed version; the fixed version number is unknown from the sources
- Until fixed, verify encrypted fields in the stored data directly

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114653
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114653

## From the sources

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_