{"id":"CVE-2026-120673","kind":"vulnerability","aliases":["CVE-2026-120673"],"related":[],"title":"MongoDB Rust Driver: tracing can log fields meant for encryption","description":"A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.","summary":"The MongoDB Rust Driver's optional tracing component can record command content before client-side field level encryption is applied. A person with read access to exported trace data can see plaintext values the application meant to encrypt, without the encryption keys.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["client-side-encryption","mongodb","package","rust","tracing"],"not_affected_if":["no-automatic-encryption","tracing-disabled"],"how_to_check":"- Check whether the application depends on the MongoDB Rust driver (`mongodb` crate) and note its version in `Cargo.lock`.\n- Check whether the tracing feature of the driver is enabled and whether automatic in-use encryption (client-side field level encryption) is configured.\n- Check whether exported trace data is stored or readable by anyone beyond the application's trust boundary.","fix":null,"status":"open","published_at":"2026-11-03T19:17:59+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","triaged_at":"2026-11-03T19:45:38+00:00","updated_at":"2026-11-03T19:45:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T19:45:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MongoDB Rust Driver: tracing can log fields meant for encryption","impact":"medium","summary":"The MongoDB Rust Driver's optional tracing component can record command content before client-side field level encryption is applied. A person with read access to exported trace data can see plaintext values the application meant to encrypt, without the encryption keys.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","mongodb","client-side-encryption","tracing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"plaintext values meant for encryption are readable in trace data","analyst_note":"Sources list only NVD; confirm the affected and fixed driver versions and whether the tracing feature is default-off, from the MongoDB advisory.","how_to_check":"- Check whether the application depends on the MongoDB Rust driver (`mongodb` crate) and note its version in `Cargo.lock`.\n- Check whether the tracing feature of the driver is enabled and whether automatic in-use encryption (client-side field level encryption) is configured.\n- Check whether exported trace data is stored or readable by anyone beyond the application's trust boundary.","plain_action":"","needs_analyst":true,"not_affected_if":["tracing-disabled","no-automatic-encryption"],"who_is_affected":"Applications that use the MongoDB Rust driver with its optional tracing turned on together with automatic in-use encryption. Exposure requires that exported trace data is readable by a party without the encryption keys. Applications that do not enable tracing or do not use automatic encryption are likely not affected, though the sources do not say this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4150,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120673':13A,16A '-2026':12A,15A 'access':50B,114C,133C 'appli':45B,93C 'applic':60B,117C,128C 'automat':85C,105C 'capabl':102C 'captur':81C 'client':18B,39B,87C 'client-sid':38B,86C 'client-side-encrypt':17B 'command':35B,82C 'compon':32B,69C 'content':36B,83C 'cve':11A,14A 'data':54B,79C,121C,145C 'deploy':95C 'design':129C 'diagnost':77C 'disclosur':143C 'driver':3A,28B,74C 'encrypt':10A,20B,43B,63B,66B,91C,109C,131C,136C 'export':52B,119C 'field':7A,41B,89C,124C 'in-us':106C 'key':67B,137C 'level':42B,90C 'log':6A 'may':122C,139C 'meant':8A,61B 'mongodb':1A,21B,26B,72C 'obtain':123C 'option':30B,100C 'packag':22B 'parti':111C 'person':47B 'plaintext':57B 'read':49B,113C 'record':34B,76C 'result':140C 'rust':2A,23B,27B,73C 'see':56B 'side':19B,40B,88C 'togeth':103C 'trace':4A,24B,31B,53B,78C,101C,120C 'turn':97C 'unintend':142C 'use':108C 'valu':58B,125C 'without':64B,132C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the MongoDB Rust driver with its optional tracing turned on together with automatic in-use encryption. Exposure requires that exported trace data is readable by a party without the encryption keys. Applications that do not enable tracing or do not use automatic encryption are likely not affected, though the sources do not say this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["clientsideencryption","medium","mongodb","package","rust","tracing"],"campaign_type":null,"first_public_at":"2026-11-03T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120673","severity":null,"published_at":"2026-11-03T19:17:59+00:00","modified_at":"2026-11-03T19:17:59+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}