---
id: "CVE-2026-126817"
page: "https://infrastack.ai/live/CVE-2026-126817"
kind: "vulnerability"
aliases: ["CVE-2026-126817"]
title: "Mongoid ODM: encrypted fields can be stored in cleartext silently"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["client-side-encryption", "mongodb", "mongoid", "package", "ruby"]
not_affected_if: ["no-client-side-encryption", "one-model-per-collection"]
published_at: "2026-11-13T16:18:46+00:00"
first_seen_at: "2026-11-13T16:47:33+00:00"
updated_at: "2026-11-13T16:48:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126817", "first_seen_at": "2026-11-13T16:47:33+00:00"}]
exploit_sources: []
---

# Mongoid ODM: encrypted fields can be stored in cleartext silently

Link for people: https://infrastack.ai/live/CVE-2026-126817 (this .md is for agents)

When several Mongoid models share one storage location, fields the application marked for client-side encryption can be written to the database unencrypted, with no error raised. A database user with only read access, and no encryption keys, can then read those values in plain form.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for Mongoid models that map to the same collection and use client-side encryption (`encrypts` declarations).
- Check the installed Mongoid version in Gemfile.lock.
- Inspect stored documents for readable values in fields declared as encrypted.

## Timeline

- 2026-11-13T16:47:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126817

## From the sources

A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_