MongoDB C# Driver CVE-2026-81530

Exploitation requires two concurrent conditions: (1) the target application must use the MongoDB C

Driver with client-side field-level encryption (CSFLE) or Queryable Encryption actively configured, supplying KMS provider credentials via AutoEncryptionOptions or an equivalent configuration object - this is a non-default deployment mode not present in standard MongoDB .NET applications; and (2) the attacker must have read access to the application's log output, a log aggregation or SIEM platform ingesting those logs, or a process memory dump of the .NET application host. Exploitation is not possible against applications that do not configure client-side encryption, nor against deployments where log access is strictly controlled. Authentication requirements align with CVSS 4.0 PR:L - the attacker needs at minimum low-privileged access to the logging infrastructure, not unauthenticated remote access.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/SC:H) accurately captures the threat model: local or log-system read access with low privileges is sufficient, but AT:P correctly constrains scope to deployments where CSFLE is actively configured - a non-default state for most MongoDB applications. The VC:H and SC:H ratings reflect that KMS credential exposure does not merely disclose one record but potentially all encrypted field data across every collection using those keys, an outsized secondary blast radius. EPSS data is absent from the provided intelligence, so numerical exploitation probability cannot be stated; however, the bounded attack surface (log access plus CSFLE configuration) keeps real-world exploitation likelihood lower than a network-exploitable credential leak. KEV status is unconfirmed and no POC is known. The practical priority is highest for organizations that (a) use CSFLE or Queryable Encryption and (b) aggregate application logs in platforms accessible to broader teams - where leaked KMS credentials could be silently harvested from historical log archives.

An attacker with read access to a centralized log aggregation system queries stored application logs from a .NET service that uses the MongoDB C

Driver with CSFLE configured. The driver's diagnostic output of its client settings object appears in the logs with AWS KMS access keys or Azure client secrets reproduced in plaintext. The attacker extracts these credentials and uses them directly against the AWS KMS or Azure Key Vault API to unwrap the data-encryption keys, then decrypts protected MongoDB field values entirely outside the application's access controls.