{"id":"CVE-2026-126818","kind":"vulnerability","aliases":["CVE-2026-126818"],"related":[],"title":"Ruby object-document mapper stores encrypted-designated fields in plaintext","description":"A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses class inheritance. Values the application designated for encryption are written to the database in readable form without any error or warning. A database account holding only read access to the application's collections, and no access to the encryption key store, may obtain those values.","summary":"Mongoid (MongoDB's Ruby ODM) most likely skips client-side field-level encryption for some fields when models use class inheritance. The values are stored readable, with no error or warning. Anyone with read access to the collections or backups can see them. The CVE text does not name the gem. The match to Mongoid and to fixes 9.1.2 and 9.0.13 is inferred from the release notes.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mongoid","fixed":["9.0.13","9.1.2"],"affected":"< 9.0.13 (9.0.x), < 9.1.2 (9.1.x); lower bound unknown","ecosystem":"rubygems"}],"ecosystems":[],"tags":["csfle","field-level-encryption","inheritance","mongodb","mongoid","package","ruby"],"not_affected_if":["no-field-encryption","no-inheritance"],"how_to_check":"In Gemfile.lock, check the mongoid version. Look for models with encrypted fields that use inheritance (a subclass of another Mongoid model in the same collection). Then save a subclass record and read the raw document in mongosh. A readable value in an encrypted field means you are exposed. Treat as exposed if mongoid is below 9.0.13 (9.0.x) or below 9.1.2 (9.1.x). Other branches (8.x): unknown.","fix":"Upgrade mongoid to 9.1.2 (9.1.x) or 9.0.13 (9.0.x). After upgrading, re-save the affected records, because existing plaintext values stay plaintext until rewritten. Rotate any secrets that were stored in them.","status":"open","published_at":"2026-11-13T16:18:46+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","triaged_at":"2026-11-13T16:48:39+00:00","updated_at":"2026-11-13T16:49:45+00:00","category":"package","confidence":0.55,"triage":{"at":"2026-11-13T16:48:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Ruby object-document mapper stores encrypted-designated fields in plaintext","impact":"medium","summary":"A Ruby object-document mapper skips its automatic field-level encryption for some fields when the data model uses class inheritance. Those values are written to the database readable, with no error or warning, so anyone with read access to the collections can see them.","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","mongodb","field-level-encryption"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"database readers see values meant to be encrypted in plaintext","analyst_note":"Identify the affected Ruby mapper gem and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-126818.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-inheritance","no-field-encryption"],"who_is_affected":"Applications that use this Ruby mapper's automatic field-level encryption on models built with class inheritance are exposed. Teams whose models do not use inheritance, or who do not use field-level encryption, can skip it. The sources do not name the affected gem or the fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4553,"output_tokens":497,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected Ruby mapper gem and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-126818.","search":"'-126818':15A,18A '-2026':14A,17A '9.0.13':92B '9.1.2':90B 'access':66B,150C,158C 'account':146C 'anyon':63B 'appli':107C 'applic':127C,153C 'automat':109C 'backup':71B 'certain':116C 'class':51B,123C 'client':39B 'client-sid':38B 'collect':69B,155C 'configur':114C 'csfle':20B 'cve':13A,16A,76B 'data':120C 'databas':135C,145C 'design':9A,128C 'document':4A,103C 'encrypt':8A,24B,44B,113C,130C,161C 'encrypted-design':7A 'error':60B,141C 'field':10A,22B,42B,47B,111C,117C 'field-level':41B,110C 'field-level-encrypt':21B 'fix':89B 'form':138C 'gem':82B 'hold':147C 'infer':94B 'inherit':25B,52B,124C 'key':162C 'level':23B,43B,112C 'like':36B 'mapper':5A,104C 'match':84B 'may':164C 'model':49B,121C 'mongodb':26B,31B 'mongoid':19A,27B,30B,86B 'name':80B 'note':98B 'object':3A,102C 'object-docu':2A,101C 'obtain':165C 'odm':34B 'packag':28B 'plaintext':12A 'read':65B,149C 'readabl':57B,137C 'releas':97B 'rubi':1A,29B,33B,100C 'see':73B 'side':40B 'skip':37B 'store':6A,56B,163C 'text':77B 'use':50B,122C 'valu':54B,125C,167C 'warn':62B,143C 'without':139C 'written':132C","nicknames":[],"mitigations":[],"who_affected":"Ruby apps that use Mongoid with automatic client-side field-level encryption (encrypt: true fields) and models that inherit from each other, so subclasses share a collection. Apps without CSFLE, or with no inheritance in encrypted models, can likely skip it. This is inferred, since the CVE text does not name the product.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mongoid"],"ptokens":["mongoid"],"labels":["csfle","fieldlevelencryption","high","inheritance","mongodb","mongoid","package","ruby"],"campaign_type":null,"search_a":"'-126818':15A,18A '-2026':14A,17A 'cve':13A,16A 'design':9A 'document':4A 'encrypt':8A 'encrypted-design':7A 'field':10A 'mapper':5A 'mongoid':19A 'object':3A 'object-docu':2A 'plaintext':12A 'rubi':1A 'store':6A","search_b":"'9.0.13':92B '9.1.2':90B 'access':66B 'anyon':63B 'backup':71B 'class':51B 'client':39B 'client-sid':38B 'collect':69B 'csfle':20B 'cve':76B 'encrypt':24B,44B 'error':60B 'field':22B,42B,47B 'field-level':41B 'field-level-encrypt':21B 'fix':89B 'gem':82B 'infer':94B 'inherit':25B,52B 'level':23B,43B 'like':36B 'match':84B 'model':49B 'mongodb':26B,31B 'mongoid':27B,30B,86B 'name':80B 'note':98B 'odm':34B 'packag':28B 'read':65B 'readabl':57B 'releas':97B 'rubi':29B,33B 'see':73B 'side':40B 'skip':37B 'store':56B 'text':77B 'use':50B 'valu':54B 'warn':62B","search_c":"'access':150C,158C 'account':146C 'appli':107C 'applic':127C,153C 'automat':109C 'certain':116C 'class':123C 'collect':155C 'configur':114C 'data':120C 'databas':135C,145C 'design':128C 'document':103C 'encrypt':113C,130C,161C 'error':141C 'field':111C,117C 'field-level':110C 'form':138C 'hold':147C 'inherit':124C 'key':162C 'level':112C 'mapper':104C 'may':164C 'model':121C 'object':102C 'object-docu':101C 'obtain':165C 'read':149C 'readabl':137C 'rubi':100C 'store':163C 'use':122C 'valu':125C,167C 'warn':143C 'without':139C 'written':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:18:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126818","severity":null,"published_at":"2026-11-13T16:18:46+00:00","modified_at":"2026-11-13T16:18:46+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","fetched_at":"2026-11-13T16:47:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126818:3906","url":"https://github.com/mongodb/mongoid/releases","severity":null,"published_at":"2026-11-13T16:49:45+00:00","modified_at":"2026-11-13T16:49:45+00:00","first_seen_at":"2026-11-13T16:49:45+00:00","fetched_at":"2026-11-13T16:49:45+00:00","note":"NVD/MITRE text names no gem or versions (CNA MongoDB). Best match: Mongoid (Ruby ODM for MongoDB); release notes for 9.1.2 and 9.0.13 (12 Nov 2026) list 'Encryption schema map keeps one model per collection and drops the other models' encrypted fields' (MONGOID-6037), which fits inheritance (subclasses share a collection). The release notes do not cite this CVE id, so the link is inferred. The Jira ticket was unreachable. Affected lower bound unknown. Nothing verified. No exploitation or PoC found. Did not search X.","cites":["https://github.com/mongodb/mongoid/releases","https://vuldb.com/cve/CVE-2026-126818"]}],"documents":[{"id":147678,"url":"https://github.com/mongodb/mongoid/releases","title":"mongodb/mongoid releases (9.1.2, 9.0.13)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":147679,"url":"https://vuldb.com/cve/CVE-2026-126818","title":"VulDB: CVE-2026-126818 (MITRE text, CNA MongoDB)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}