CVE-2026-126838 · Package
NO FIX YET
The MongoDB Rust driver's client-side field level encryption settings include key management service credentials in their debug formatting without redaction. Anyone who can read an application's logs or diagnostic output can see that key material.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the MongoDB Rust driver with client-side field level encryption and that log or display the debug-formatted encryption settings. Exposure depends on who can read those logs or diagnostics. Applications that do not enable client-side encryption, or that never output these settings, are unlikely to be affected.
Not affected if logs-not-exposed, no-client-side-encryption
Who cares client-side-encryption, mongodb, rust
mongodb crate) with client-side field level encryption enabled.Cargo.lock.No fix yet, per the sources.
A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.