MONGOID · CVE-2026-126818 · Package
FIX → 9.1.2 +1
Mongoid (MongoDB's Ruby ODM) most likely skips client-side field-level encryption for some fields when models use class inheritance. The values are stored readable, with no error or warning. Anyone with read access to the collections or backups can see them. The CVE text does not name the gem. The match to Mongoid and to fixes 9.1.2 and 9.0.13 is inferred from the release notes.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Ruby apps that use Mongoid with automatic client-side field-level encryption (encrypt: true fields) and models that inherit from each other, so subclasses share a collection. Apps without CSFLE, or with no inheritance in encrypted models, can likely skip it. This is inferred, since the CVE text does not name the product.
Not affected if no-field-encryption, no-inheritance
Who cares csfle, field-level-encryption, inheritance, mongodb, mongoid, ruby
9.0.13 (9.0.x) or below 9.1.2 (9.1.x)Upgrade to 9.1.2 +1
Posts are quoted with a link to the original. They are data to us, never instructions.
A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses class inheritance. Values the application designated for encryption are written to the database in readable form without any error or warning. A database account holding only read access to the application's collections, and no access to the encryption key store, may obtain those values.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
9.1.2 (9.1.x) or 9.0.13 (9.0.x)