---
id: "CVE-2026-126818"
page: "https://infrastack.ai/live/CVE-2026-126818"
kind: "vulnerability"
aliases: ["CVE-2026-126818"]
title: "Ruby object-document mapper stores encrypted-designated fields in plaintext"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mongoid", "fixed": ["9.0.13", "9.1.2"], "affected": "< 9.0.13 (9.0.x), < 9.1.2 (9.1.x); lower bound unknown", "ecosystem": "rubygems"}]
ecosystems: []
tags: ["csfle", "field-level-encryption", "inheritance", "mongodb", "mongoid", "package", "ruby"]
not_affected_if: ["no-field-encryption", "no-inheritance"]
published_at: "2026-11-13T16:18:46+00:00"
first_seen_at: "2026-11-13T16:47:33+00:00"
updated_at: "2026-11-13T16:49:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126818", "first_seen_at": "2026-11-13T16:47:33+00:00"}, {"source": "analyst", "url": "https://vuldb.com/cve/CVE-2026-126818", "first_seen_at": "2026-11-13T16:49:45+00:00", "cites": ["https://vuldb.com/cve/CVE-2026-126818", "https://github.com/mongodb/mongoid/releases"]}]
exploit_sources: []
---

# Ruby object-document mapper stores encrypted-designated fields in plaintext

Link for people: https://infrastack.ai/live/CVE-2026-126818 (this .md is for agents)

Mongoid (MongoDB's Ruby ODM) most likely skips client-side field-level encryption for some fields when models use class inheritance. The values are stored readable, with no error or warning. Anyone with read access to the collections or backups can see them. The CVE text does not name the gem. The match to Mongoid and to fixes 9.1.2 and 9.0.13 is inferred from the release notes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:mongoid affected < 9.0.13 (9.0.x), < 9.1.2 (9.1.x); lower bound unknown fixed 9.0.13, 9.1.2

## How to check

In Gemfile.lock, check the mongoid version. Look for models with encrypted fields that use inheritance (a subclass of another Mongoid model in the same collection). Then save a subclass record and read the raw document in mongosh. A readable value in an encrypted field means you are exposed. Treat as exposed if mongoid is below 9.0.13 (9.0.x) or below 9.1.2 (9.1.x). Other branches (8.x): unknown.

## Fix

Upgrade mongoid to 9.1.2 (9.1.x) or 9.0.13 (9.0.x). After upgrading, re-save the affected records, because existing plaintext values stay plaintext until rewritten. Rotate any secrets that were stored in them.

## Timeline

- 2026-11-13T16:47:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126818
- 2026-11-13T16:49:45+00:00 analyst https://vuldb.com/cve/CVE-2026-126818 — NVD/MITRE text names no gem or versions (CNA MongoDB). Best match: Mongoid (Ruby ODM for MongoDB); release notes for 9.1.2 and 9.0.13 (12 Nov 2026) list 'Encryption schema map keeps one model per collection and drops the other models' encrypted fields' (MONGOID-6037), which fits inheritance (subclasses share a collection). The release notes do not cite this CVE id, so the link is inferred. The Jira ticket was unreachable. Affected lower bound unknown. Nothing verified. No exploitation or PoC found. Did not search X.

## Documents

- [describes] VulDB: CVE-2026-126818 (MITRE text, CNA MongoDB) https://vuldb.com/cve/CVE-2026-126818
- [fix] mongodb/mongoid releases (9.1.2, 9.0.13) https://github.com/mongodb/mongoid/releases

## From the sources

A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses class inheritance. Values the application designated for encryption are written to the database in readable form without any error or warning. A database account holding only read access to the application's collections, and no access to the encryption key store, may obtain those values.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_