EUVD-2026-67214Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local log read access with low privileges is sufficient; scope changes because recovered KMS credentials compromise encrypted data in an external key management system.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A weakness in the client-side encryption configuration surface of the MongoDB C
Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.
AnalysisAI
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are reproduced in plaintext within the driver's diagnostic string representation of its client settings, rather than being masked like other secret fields. Any party with read access to application logs, diagnostic output, or process memory dumps can recover these credentials and independently invoke the key management service to unwrap data-encryption keys, compromising all data protected by those keys. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the target application must use the MongoDB C# Driver with client-side field-level encryption (CSFLE) or Queryable Encryption actively configured, supplying KMS provider credentials via AutoEncryptionOptions or an equivalent configuration object - this is a non-default deployment mode not present in standard MongoDB .NET applications; and (2) the attacker must have read access to the application's log output, a log aggregation or SIEM platform ingesting those logs, or a process memory dump of the .NET application host. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/SC:H) accurately captures the threat model: local or log-system read access with low privileges is sufficient, but AT:P correctly constrains scope to deployments where CSFLE is actively configured - a non-default state for most MongoDB applications. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the MongoDB C# Driver (MongoDB.Driver NuGet package) to version 3.11.1 or later, available at https://www.nuget.org/packages/MongoDB.Driver/3.11.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabli
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rate
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation,
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged atta
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a co
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vu
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today