EUVD-2026-82377
GHSA-2cv7-5prw-3mqp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation needs the specific combined-encryption configuration (AC:H) and app/config control (PR:L); data lands in the datastore (S:C, C:H) with no integrity/availability impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
AnalysisAI
MongoDB EF Core silently drops TLS and schema-map (client-side field-level/queryable encryption field map) settings when an application configures encryption both through independent/application-level settings and through the provider's own encryption settings, causing fields that were meant to be encrypted to be persisted in the database as cleartext. Only .NET applications built on the MongoDB Entity Framework Core Provider that combine both encryption configuration paths are affected; deployments using a single path, or not using field encryption at all, are not affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Applies specifically to applications built on the MongoDB Entity Framework Core Provider that configure encryption via independent/manual encryption settings AND simultaneously through the provider's encryption settings; when these are combined, the provider silently loses TLS and schema-map (client-side field-level/queryable encryption field map) settings, causing fields intended to be encrypted to be stored in cleartext. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a configuration/weakness-class data-protection failure (CWE-311, Missing Encryption of Sensitive Data), not an actively-exploitable remote code path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; track the MongoDB Jira issue EF-388 (https://jira.mongodb.org/browse/EF-388) for the fixed provider release and upgrade as soon as a patched version is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthent
Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files o
Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs ena
Same weakness CWE-311 – Missing Encryption of Sensitive Data
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today