---
id: "CVE-2026-126838"
page: "https://infrastack.ai/live/CVE-2026-126838"
kind: "vulnerability"
aliases: ["CVE-2026-126838"]
title: "MongoDB Rust driver: encryption settings leak key service credentials in debug output"
severity: "medium"
cvss: 5.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["client-side-encryption", "mongodb", "package", "rust"]
not_affected_if: ["logs-not-exposed", "no-client-side-encryption"]
published_at: "2026-11-12T19:17:01+00:00"
first_seen_at: "2026-11-12T19:40:13+00:00"
updated_at: "2026-11-12T19:40:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126838", "first_seen_at": "2026-11-12T19:40:13+00:00"}]
exploit_sources: []
---

# MongoDB Rust driver: encryption settings leak key service credentials in debug output

Link for people: https://infrastack.ai/live/CVE-2026-126838 (this .md is for agents)

The MongoDB Rust driver's client-side field level encryption settings include key management service credentials in their debug formatting without redaction. Anyone who can read an application's logs or diagnostic output can see that key material.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application uses the MongoDB Rust driver (`mongodb` crate) with client-side field level encryption enabled.
- Check the driver version in `Cargo.lock`.
- Check whether application logs or debug output print encryption settings.

## Timeline

- 2026-11-12T19:40:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126838

## From the sources

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_