EUVD-2026-67207Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector (AV:L) and low privileges (PR:L) required to supply crafted namespace; limited confidentiality and integrity impact only; no availability impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
AnalysisAI
Input injection in MongoDB libmongocrypt's automatic-encryption context setup permits caller-supplied database and collection name arguments containing '.' or NUL bytes to pass without sanitization, causing incorrect schema selection during Client-Side Field Level Encryption (CSFLE) operations. Affected callers - those with local access and low privileges - may obtain limited unauthorized disclosure or modification of data processed under the wrong encryption schema. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target application must have MongoDB Client-Side Field Level Encryption (CSFLE) configured with automatic encryption enabled - this is a non-default, explicitly configured feature; (2) the attacker must have local access and low privileges sufficient to influence the database or collection name argument passed to the libmongocrypt automatic-encryption context (AV:L, PR:L from the CVSS 4.0 vector); (3) specific attack prerequisites must be satisfied (AT:P), meaning the attacker cannot trivially reach the vulnerable code path without controlling an input at the application or driver API layer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The risk signals are uniformly low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged caller - such as a compromised microservice or a malicious internal application component - supplies a crafted database name containing '.' or a NUL byte to the libmongocrypt automatic-encryption context setup API. The unsanitized input causes the library to resolve the wrong namespace, selecting an unintended encryption schema for the operation. … |
| Remediation | Upgrade libmongocrypt to version 1.20.3, which validates database and collection name arguments against '.' and NUL bytes per the fix documented at https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Libmongocrypt
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today