MONGODB SERVER · CVE-2026-120813 · Runtime
FIX → 9.0.7 · 8.3.16 · 7.0.48 +1 ✓ verified
A flaw in how MongoDB Server's client-side field-level encryption (CSFLE) parses schemas can silently drop encryption metadata. An attacker who can deliver a crafted schema to a client can cause data meant for encryption to be stored in plaintext.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running MongoDB Server 7.0, 8.0, 8.3 or 9.0 below the fixed releases whose clients use client-side field-level encryption with a schema that someone else can influence (a man-in-the-middle position or an untrusted server). With duplicate keys, one entry's encryption settings overwrite another's, so a field you expected encrypted is stored in plaintext. Teams without CSFLE, or with a locally fixed schema nobody else can alter, can skip it.
Not affected if local-schema-only, no-csfle
Who cares csfle, drivers, encryption, mongodb, self-hosted
7.0.48, 8.0.37, 8.3.16, 9.0.77.0.0-7.0.47, 8.0.0-8.0.36, 8.3.0-8.3.15, Posts are quoted with a link to the original. They are data to us, never instructions.
An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.0.0-9.0.6Upgrade to 9.0.7 · 8.3.16 · 7.0.48 +1
9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later on your line)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.