{"id":"CVE-2026-126838","kind":"vulnerability","aliases":["CVE-2026-126838"],"related":[],"title":"MongoDB Rust driver: encryption settings leak key service credentials in debug output","description":"A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.","summary":"The MongoDB Rust driver's client-side field level encryption settings include key management service credentials in their debug formatting without redaction. Anyone who can read an application's logs or diagnostic output can see that key material.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["client-side-encryption","mongodb","package","rust"],"not_affected_if":["logs-not-exposed","no-client-side-encryption"],"how_to_check":"- Check whether the application uses the MongoDB Rust driver (`mongodb` crate) with client-side field level encryption enabled.\n- Check the driver version in `Cargo.lock`.\n- Check whether application logs or debug output print encryption settings.","fix":null,"status":"open","published_at":"2026-11-12T19:17:01+00:00","first_seen_at":"2026-11-12T19:40:13+00:00","triaged_at":"2026-11-12T19:40:57+00:00","updated_at":"2026-11-12T19:40:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T19:40:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MongoDB Rust driver: encryption settings leak key service credentials in debug output","impact":"medium","summary":"The MongoDB Rust driver's client-side field level encryption settings include key management service credentials in their debug formatting without redaction. Anyone who can read an application's logs or diagnostic output can see that key material.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongodb","rust","client-side-encryption"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"key management service credentials readable from application diagnostic output","analyst_note":"Find the affected and fixed driver versions in the NVD entry or MongoDB advisory; the sources give no version ranges.","how_to_check":"- Check whether the application uses the MongoDB Rust driver (`mongodb` crate) with client-side field level encryption enabled.\n- Check the driver version in `Cargo.lock`.\n- Check whether application logs or debug output print encryption settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-client-side-encryption","logs-not-exposed"],"who_is_affected":"Applications that use the MongoDB Rust driver with client-side field level encryption and that log or display the debug-formatted encryption settings. Exposure depends on who can read those logs or diagnostics. Applications that do not enable client-side encryption, or that never output these settings, are unlikely to be affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4548,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126838':15A,18A '-2026':14A,17A 'access':110C 'anyon':49B 'applic':54B,93C,113C 'client':20B,32B,73C 'client-sid':31B,72C 'client-side-encrypt':19B 'compon':69C 'credenti':9A,42B,83C 'cve':13A,16A 'debug':11A,45B 'diagnost':58B,87C,115C 'disclosur':125C 'display':97C 'driver':3A,29B,68C 'encrypt':4A,22B,36B,77C 'field':34B,75C 'format':46B,88C,99C 'hold':71C 'includ':38B,79C 'key':7A,39B,63B,80C,127C 'leak':6A 'level':35B,76C 'log':56B 'manag':40B,81C 'materi':64B,84C,104C,128C 'may':101C,121C 'mongodb':1A,23B,27B,66C 'output':12A,59B,89C,100C,116C 'packag':24B 'parti':107C 'place':102C 'read':52B,109C 'record':95C 'redact':48B,91C 'result':122C 'rust':2A,25B,28B,67C 'see':61B,118C 'servic':8A,41B,82C 'set':5A,37B,78C 'side':21B,33B,74C 'unintend':124C 'without':47B,90C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the MongoDB Rust driver with client-side field level encryption and that log or display the debug-formatted encryption settings. Exposure depends on who can read those logs or diagnostics. Applications that do not enable client-side encryption, or that never output these settings, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["clientsideencryption","medium","mongodb","package","rust"],"campaign_type":null,"search_a":"'-126838':15A,18A '-2026':14A,17A 'credenti':9A 'cve':13A,16A 'debug':11A 'driver':3A 'encrypt':4A 'key':7A 'leak':6A 'mongodb':1A 'output':12A 'rust':2A 'servic':8A 'set':5A","search_b":"'anyon':49B 'applic':54B 'client':20B,32B 'client-sid':31B 'client-side-encrypt':19B 'credenti':42B 'debug':45B 'diagnost':58B 'driver':29B 'encrypt':22B,36B 'field':34B 'format':46B 'includ':38B 'key':39B,63B 'level':35B 'log':56B 'manag':40B 'materi':64B 'mongodb':23B,27B 'output':59B 'packag':24B 'read':52B 'redact':48B 'rust':25B,28B 'see':61B 'servic':41B 'set':37B 'side':21B,33B 'without':47B","search_c":"'access':110C 'applic':93C,113C 'client':73C 'client-sid':72C 'compon':69C 'credenti':83C 'diagnost':87C,115C 'disclosur':125C 'display':97C 'driver':68C 'encrypt':77C 'field':75C 'format':88C,99C 'hold':71C 'includ':79C 'key':80C,127C 'level':76C 'manag':81C 'materi':84C,104C,128C 'may':101C,121C 'mongodb':66C 'output':89C,100C,116C 'parti':107C 'place':102C 'read':109C 'record':95C 'redact':91C 'result':122C 'rust':67C 'see':118C 'servic':82C 'set':78C 'side':74C 'unintend':124C 'without':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126838","severity":null,"published_at":"2026-11-12T19:17:01+00:00","modified_at":"2026-11-12T19:17:01+00:00","first_seen_at":"2026-11-12T19:40:13+00:00","fetched_at":"2026-11-12T19:40:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}