MongoDB Rust Driver CVE-2026-120673

Exploitation requires a specific, non-default combination: the application must enable BOTH the MongoDB Rust Driver's optional diagnostic tracing capability AND automatic client-side (in-use) field level encryption. Only then does the driver capture command content into trace data before encryption is applied. The attacker further needs read access to the application's exported trace data (consistent with CVSS AV:L and PR:L) - this is a local/authenticated prerequisite, not remote unauthenticated access. Limiting factors that reduce real-world exposure: both features are opt-in, so default or tracing-disabled deployments are not affected; no keys are needed but the attacker must already be able to read the trace output; and impact is confined to disclosure of fields the application explicitly designated for encryption, with no integrity or availability impact.

This is a moderate-severity information-disclosure issue (CWE-532, sensitive data written to diagnostic traces) that is a real but conditional priority rather than an urgent emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 6.8) indicates LOCAL attack vector with low privileges required and no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with the description, in which the harm is exposure of encryption-designated field values to a party who can read the application's exported trace data. The vuln.today decision label is 'this_month', which signals a scheduled-remediation priority, not act_now/emergency. There is no CISA KEV listing and no EPSS score provided, so there is no signal of active or probable exploitation; exploitation status is best characterized as no public exploit identified. The signals are internally consistent (local vector + authenticated access to trace data + confidentiality-only impact all align), so there is no network-vs-local or KEV-vs-EPSS conflict to flag. The key caveat is exposure surface: real risk depends entirely on how trace data is handled downstream (centralized logging, SIEM, shared log stores), which the CVE data does not describe.

An application uses the MongoDB Rust Driver with both the optional diagnostic tracing feature and automatic client-side field level encryption (CSFLE) enabled; the driver records command content into traces before encryption is applied. A party with read access to the exported trace output (for example a log aggregation store or operator with log-read rights) reads the plaintext of fields the application intended to keep encrypted, without ever needing the encryption keys. No public exploit code is identified at time of analysis; the only reference is a MongoDB Jira tracking entry.