---
id: "CVE-2026-120673"
kind: "vulnerability"
aliases: ["CVE-2026-120673"]
title: "MongoDB Rust Driver: tracing can log fields meant for encryption"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["client-side-encryption", "mongodb", "package", "rust", "tracing"]
not_affected_if: ["no-automatic-encryption", "tracing-disabled"]
published_at: "2026-11-03T19:17:59+00:00"
first_seen_at: "2026-11-03T19:44:52+00:00"
updated_at: "2026-11-03T19:45:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120673", "first_seen_at": "2026-11-03T19:44:52+00:00"}]
---

# MongoDB Rust Driver: tracing can log fields meant for encryption

The MongoDB Rust Driver's optional tracing component can record command content before client-side field level encryption is applied. A person with read access to exported trace data can see plaintext values the application meant to encrypt, without the encryption keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application depends on the MongoDB Rust driver (`mongodb` crate) and note its version in `Cargo.lock`.
- Check whether the tracing feature of the driver is enabled and whether automatic in-use encryption (client-side field level encryption) is configured.
- Check whether exported trace data is stored or readable by anyone beyond the application's trust boundary.

## Timeline

- 2026-11-03T19:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120673

## From the sources

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_