EUVD-2026-83199
GHSA-5qw9-p5cj-5jx4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reading the leaked cleartext requires ordinary database read access (PR:L) over the network (AV:N); pure high confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.
AnalysisAI
Silent, warning-free failure of encryption-configuration generation in the Mongoid object-document mapper causes fields that an application explicitly declared for client-side field-level encryption (CSFLE) to be written to MongoDB as cleartext, allowing any party with ordinary read access to the database - a DBA, a read replica, a backup, or a lower-privilege account with query rights - to read values that were intended to be protected from them. Only applications built on Mongoid that use MongoDB CSFLE and declare fields for encryption are affected; the CVSS vectors (the supplied 4.0 vector with PR:L and the independently assessed 3.1 vector with PR:L) indicate the attacker requires some existing privilege, consistent with the assessed precondition of ordinary database read access rather than an unauthenticated remote path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific deployment: an application built on Mongoid that uses MongoDB client-side field-level encryption (CSFLE) and declares fields for encryption, hitting the buggy encryption-configuration generation path so those fields are silently persisted in cleartext. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional data-protection failure rather than an actively exploited priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified in the available data and no fixed version can be cited, so remediation must begin with tracking the vendor ticket referenced by the CVE, https://jira.mongodb.org/browse/MONGOID-5984, and applying the corrected Mongoid release as soon as it is published - do not assume any current version is safe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application built on Mongoid that uses MongoDB CSFLE and declares fields for encryption, and inspect stored documents directly to determine whether those fields are held as ciphertext or cleartext; treat any confirmed cleartext as a data-exposure incident, restrict read access to the affected databases, read replicas, and backups to the minimum necessary accounts, and halt any replication or export of the affected collections to lower-trust environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Ruby before 2.4.3 allows Net::FTP command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injectio
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call
Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Rated critical severi
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Rated critical severity (CVSS 9.8), this vulnerabilit
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Rub
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) w
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and tru
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today