Live › vulnerability › CVE-2026-120673
The MongoDB Rust Driver's optional tracing component can record command content before client-side field level encryption is applied. A person with read access to exported trace data can see plaintext values the application meant to encrypt, without the encryption keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Applications that use the MongoDB Rust driver with its optional tracing turned on together with automatic in-use encryption. Exposure requires that exported trace data is readable by a party without the encryption keys. Applications that do not enable tracing or do not use automatic encryption are likely not affected, though the sources do not say this explicitly.
No product ranges from the sources yet.
mongodb crate) and note its version in Cargo.lock.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.
This page as .md · .json · in your agent: get_signal("CVE-2026-120673")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.