Which versions of MongoDB Server are affected by CVE-2026-9741?

MongoDB Server's Queryable Encryption and Client-Side Field Level Encryption are compromised in deployments using $vectorSearch queries, causing encrypted data to be transmitted as plaintext to the…. A patch is available.

How to fix or mitigate CVE-2026-9741?

Within 24 hours: Inventory all MongoDB Server deployments using Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) in combination with $vectorSearch queries, including affected versions and classification of data at risk. Within 7 days: Implement interim controls including disabling $vectorSearch for encrypted fields, restricting database network access to trusted applications, enabling MongoDB audit logging at field level, and monitoring query patterns. Within 30 days: Establish expedited patching plan with MongoDB support, evaluate architectural alternatives to $vectorSearch for encrypted data, and conduct data exposure assessment to determine if plaintext transmission of sensitive values has occurred.

MongoDB Server CVE-2026-9741

Q: What is the CVSS score of CVE-2026-9741?

CVE-2026-9741 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35859 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-06-09 mongodb

GHSA-jp8p-fq38-v738

Information Disclosure MongoDB Mongodb Server

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Updated

Jun 09, 2026 - 23:38 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 09, 2026 - 23:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 09, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Jun 09, 2026 - 23:22 NVD

MEDIUM HIGH

CVSS changed

Jun 09, 2026 - 23:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jun 09, 2026 - 22:48 vuln.today

DescriptionCVE.org

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.

AnalysisAI

Sensitive information disclosure in MongoDB Server affects deployments using Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) when issuing $vectorSearch aggregation queries. Due to a flaw in client-side query analysis, literal values intended for encrypted fields inside $vectorSearch filter expressions are transmitted to the server as plaintext instead of ciphertext, defeating the confidentiality guarantee of client-side encryption. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

MongoDB's Queryable Encryption and Client-Side Field Level Encryption are designed so that sensitive field values are encrypted on the client before transmission, ensuring the database server only handles ciphertext. The bug lives in the client driver / mongocryptd query analysis path that decides which literals in an aggregation pipeline need to be replaced with their encrypted equivalents. For the $vectorSearch stage - used for similarity search over vector embeddings - the analyzer fails to recognize literal values inside filter expressions as belonging to encrypted fields, so those values bypass encryption and reach the server in cleartext, matching the root cause class described in CWE-319 (Cleartext Transmission of Sensitive Information). The affected component per the CPE is mongodb:mongodb_server, though the defect is fundamentally in the encryption-aware query processing tied to QE/CSFLE.

RemediationAI

Patch availability per vendor advisory is referenced through MongoDB ticket SERVER-123507 (https://jira.mongodb.org/browse/SERVER-123507); operators should upgrade MongoDB Server, the MongoDB drivers, and the crypt_shared / mongocryptd query analyzer to the fixed versions listed in that advisory once published - no exact fix version is enumerated in the provided input. As a compensating control until patched, avoid issuing $vectorSearch aggregation stages against collections that contain QE/CSFLE-encrypted fields, or rewrite vector search filters so they reference only non-encrypted fields (trade-off: loses the ability to filter vector results by encrypted attributes). Operators handling previously transmitted data should also rotate any field values that may have been sent in cleartext and audit server logs, oplog, and backups for residual plaintext, since cleartext that has reached storage cannot be retroactively re-encrypted by client upgrades alone.