{"id":"CVE-2026-126817","kind":"vulnerability","aliases":["CVE-2026-126817"],"related":[],"title":"Mongoid ODM: encrypted fields can be stored in cleartext silently","description":"A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.","summary":"When several Mongoid models share one storage location, fields the application marked for client-side encryption can be written to the database unencrypted, with no error raised. A database user with only read access, and no encryption keys, can then read those values in plain form.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["client-side-encryption","mongodb","mongoid","package","ruby"],"not_affected_if":["no-client-side-encryption","one-model-per-collection"],"how_to_check":"- Look for Mongoid models that map to the same collection and use client-side encryption (`encrypts` declarations).\n- Check the installed Mongoid version in Gemfile.lock.\n- Inspect stored documents for readable values in fields declared as encrypted.","fix":null,"status":"open","published_at":"2026-11-13T16:18:46+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","triaged_at":"2026-11-13T16:48:52+00:00","updated_at":"2026-11-13T16:48:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T16:48:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Mongoid ODM: encrypted fields can be stored in cleartext silently","impact":"medium","summary":"When several Mongoid models share one storage location, fields the application marked for client-side encryption can be written to the database unencrypted, with no error raised. A database user with only read access, and no encryption keys, can then read those values in plain form.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongoid","ruby","mongodb","client-side-encryption"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Encrypted field values readable in cleartext by a read-only database user","analyst_note":"Find the fixed Mongoid version and advisory for CVE-2026-126817 via the NVD link; sources give no product ranges.","how_to_check":"- Look for Mongoid models that map to the same collection and use client-side encryption (`encrypts` declarations).\n- Check the installed Mongoid version in Gemfile.lock.\n- Inspect stored documents for readable values in fields declared as encrypted.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-client-side-encryption","one-model-per-collection"],"who_is_affected":"Applications that use the Mongoid ODM with automatic client-side encryption, where more than one model is mapped onto the same collection. Applications without client-side encryption, or with one model per collection, are unlikely to be affected. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4569,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126817':13A,16A '-2026':12A,15A 'access':59B,133C 'account':130C 'applic':35B,92C 'automat':76C 'caus':88C 'clear':145C 'cleartext':9A,102C 'client':18B,39B,78C 'client-sid':38B,77C 'client-side-encrypt':17B 'cve':11A,14A 'databas':47B,54B,129C 'declar':93C 'encrypt':3A,20B,41B,62B,80C,95C,136C 'error':51B,116C 'field':4A,33B 'flaw':73C 'form':71B,146C 'generat':82C 'hold':123C 'key':63B,137C 'locat':32B,114C 'map':109C 'mark':36B 'materi':138C 'may':87C,139C 'model':28B,107C 'mongodb':21B 'mongoid':1A,22B,27B,85C 'obtain':141C 'odm':2A,86C 'one':30B,106C 'onto':110C 'ordinari':125C 'packag':23B 'parti':122C 'plain':70B 'rais':52B,120C 'read':58B,66B,127C 'read-on':126C 'rubi':24B 'schema':81C 'sever':26B 'share':29B 'side':19B,40B,79C 'silent':10A 'storag':31B,113C 'store':7A,100C 'unencrypt':48B 'user':55B 'valu':68B,89C,143C 'warn':118C 'written':44B,98C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Mongoid ODM with automatic client-side encryption, where more than one model is mapped onto the same collection. Applications without client-side encryption, or with one model per collection, are unlikely to be affected. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["clientsideencryption","medium","mongodb","mongoid","package","ruby"],"campaign_type":null,"search_a":"'-126817':13A,16A '-2026':12A,15A 'cleartext':9A 'cve':11A,14A 'encrypt':3A 'field':4A 'mongoid':1A 'odm':2A 'silent':10A 'store':7A","search_b":"'access':59B 'applic':35B 'client':18B,39B 'client-sid':38B 'client-side-encrypt':17B 'databas':47B,54B 'encrypt':20B,41B,62B 'error':51B 'field':33B 'form':71B 'key':63B 'locat':32B 'mark':36B 'model':28B 'mongodb':21B 'mongoid':22B,27B 'one':30B 'packag':23B 'plain':70B 'rais':52B 'read':58B,66B 'rubi':24B 'sever':26B 'share':29B 'side':19B,40B 'storag':31B 'unencrypt':48B 'user':55B 'valu':68B 'written':44B","search_c":"'access':133C 'account':130C 'applic':92C 'automat':76C 'caus':88C 'clear':145C 'cleartext':102C 'client':78C 'client-sid':77C 'databas':129C 'declar':93C 'encrypt':80C,95C,136C 'error':116C 'flaw':73C 'form':146C 'generat':82C 'hold':123C 'key':137C 'locat':114C 'map':109C 'materi':138C 'may':87C,139C 'model':107C 'mongoid':85C 'obtain':141C 'odm':86C 'one':106C 'onto':110C 'ordinari':125C 'parti':122C 'rais':120C 'read':127C 'read-on':126C 'schema':81C 'side':79C 'storag':113C 'store':100C 'valu':89C,143C 'warn':118C 'written':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:18:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126817","severity":null,"published_at":"2026-11-13T16:18:46+00:00","modified_at":"2026-11-13T16:18:46+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","fetched_at":"2026-11-13T16:47:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}