Skip to main content

MongoDB EF Provider CVE-2026-92757

| EUVDEUVD-2026-82382 MEDIUM
Missing Encryption of Sensitive Data (CWE-311)
2026-09-17 mongodb GHSA-r5h6-p8wg-h467
Information Disclosure .NET Mongodb Inc Mongodb Entity Framework Core Provider
6.8
CVSS 4.0 · Vendor: mongodb
Share

Severity by source

Vendor (mongodb) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.6 MEDIUM

Confidentiality-only exposure of data that should be encrypted (C:H, I/A:N); the specific connection-string precondition maps to AC:H, exposure of the datastore is a scope change (S:C), and access-gated so PR:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Metadata Corrected
Sep 17, 2026 - 20:40 vuln.today
tag: .NET added
Patch available
Sep 17, 2026 - 20:19 EUVD
Analysis Generated
Sep 17, 2026 - 19:47 vuln.today

DescriptionCVE.org

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

AnalysisAI

Field level encryption can be silently disabled in applications built on the MongoDB Entity Framework Core Provider when the connection string places a database name there, causing sensitive fields to be stored or read without the intended protection. This affects only applications that rely on field level encryption to protect sensitive data; deployments not using FLE are unaffected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the specific, developer-introduced configuration where an application built on the MongoDB Entity Framework Core Provider places a database name directly in the connection string; this inadvertently disables field level encryption. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a data-protection weakness (CWE-311, Missing Encryption of Sensitive Data), not a memory-corruption or code-execution flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch version is identified in the available data; consult MongoDB Jira EF-389 (https://jira.mongodb.org/browse/EF-389) for patch status and version-specific guidance. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in .NET

View all
CVE-2023-7334 CRITICAL POC
9.8 Jan 15

Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
CVE-2026-75513 CRITICAL POC
9.1 Sep 16

SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
CVE-2019-25359 HIGH POC
8.2 Feb 18

SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
CVE-2026-25925 HIGH POC
7.8 Feb 09

PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
CVE-2025-24070 HIGH POC
7.0 Mar 11

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
CVE-2026-26282 MEDIUM POC
6.6 Feb 19

NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser

CVE-2026-27709 MEDIUM POC
6.6 Feb 26

Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
CVE-2020-37103 MEDIUM POC
6.4 Feb 03

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
CVE-2026-3263 MEDIUM POC
6.3 Feb 26

Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
CVE-2026-26222 CRITICAL
9.8 Feb 24

Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthent
CVE-2026-25592 CRITICAL POC
9.9 Feb 06

Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files o
CVE-2026-26333 CRITICAL
9.8 Feb 13

Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs ena

Same weakness CWE-311 – Missing Encryption of Sensitive Data

View all
CVE-2026-34486 HIGH POC
7.5
CVE-2017-8221 HIGH POC
7.5
CVE-2019-11367 CRITICAL POC
9.8
CVE-2025-69969 CRITICAL POC
9.6
CVE-2019-18800 HIGH POC
8.8
CVE-2017-6445 HIGH POC
8.1
CVE-2019-5448 HIGH POC
8.1
CVE-2018-5261 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-92757 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy