CVE-2026-126817 · Package
NO FIX YET
When several Mongoid models share one storage location, fields the application marked for client-side encryption can be written to the database unencrypted, with no error raised. A database user with only read access, and no encryption keys, can then read those values in plain form.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the Mongoid ODM with automatic client-side encryption, where more than one model is mapped onto the same collection. Applications without client-side encryption, or with one model per collection, are unlikely to be affected. The sources do not name a fixed version.
Not affected if no-client-side-encryption, one-model-per-collection
Who cares client-side-encryption, mongodb, mongoid, ruby
encrypts declarations).No fix yet, per the sources.
A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.