---
id: "CVE-2026-120813"
page: "https://infrastack.ai/live/CVE-2026-120813"
kind: "vulnerability"
aliases: ["CVE-2026-120813"]
title: "MongoDB Server: duplicate keys in a CSFLE schema can leave encrypted fields in plaintext"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "MongoDB Server", "fixed": ["7.0.48", "8.0.37", "8.3.16", "9.0.7"], "affected": ">= 7.0.0, < 7.0.48; >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["csfle", "drivers", "encryption", "mongodb", "runtime", "self-hosted"]
not_affected_if: ["local-schema-only", "no-csfle"]
published_at: "2026-11-10T20:18:51+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T21:02:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120813", "first_seen_at": "2026-11-10T20:46:02+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-132517", "first_seen_at": "2026-11-10T21:02:08+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-132517", "https://cve.circl.lu/vuln/cve-2026-120813"]}]
exploit_sources: []
---

# MongoDB Server: duplicate keys in a CSFLE schema can leave encrypted fields in plaintext

Link for people: https://infrastack.ai/live/CVE-2026-120813 (this .md is for agents)

A flaw in how MongoDB Server's client-side field-level encryption (CSFLE) parses schemas can silently drop encryption metadata. An attacker who can deliver a crafted schema to a client can cause data meant for encryption to be stored in plaintext.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 7.0.0, < 7.0.48; >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7 fixed 7.0.48, 8.0.37, 8.3.16, 9.0.7

## How to check

Run mongod --version (or db.version()) and compare to the fixed releases: 7.0.48, 8.0.37, 8.3.16, 9.0.7. Affected: 7.0.0-7.0.47, 8.0.0-8.0.36, 8.3.0-8.3.15, 9.0.0-9.0.6. Then check whether your clients use CSFLE (autoEncryption / schemaMap, or a server-supplied jsonSchema) and whether any schema could contain duplicate property keys or identical patternProperties regexes; a schema you define locally and control is not attacker-supplied.

## Fix

Upgrade MongoDB Server to 9.0.7, 8.3.16, 8.0.37 or 7.0.48 (or later on your line). The fix rejects CSFLE schemas with duplicate properties/patternProperties keys (FailedToParse).

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120813
- 2026-11-10T21:02:08+00:00 analyst https://jira.mongodb.org/browse/SERVER-132517 — Fix versions from MongoDB Jira SERVER-132517 (vendor); affected ranges from MongoDB CNA CVE record (via CIRCL mirror; NVD page returned nothing). No exploitation or PoC found; no social search done (low-profile B). Product ranges not marked verified; the CNA CPE status is 'guessed'. No code check: depends on schema provenance.

## Documents

- [advisory] SERVER-132517: Reject duplicate keys in CSFLE encryption schema tree https://jira.mongodb.org/browse/SERVER-132517
- [describes] CVE-2026-120813 CVE record (MongoDB CNA) via Vulnerability-Lookup https://cve.circl.lu/vuln/cve-2026-120813

## From the sources

An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_