MongoDB Server: Plaintext storage of encrypted fields via duplicate schema keys
Summary
MongoDB Server's client-side field-level encryption (CSFLE) schema processing silently drops encryption metadata when a schema contains duplicate keys in properties or patternProperties. Sensitive fields intended for encryption can then be stored in plaintext, bypassing confidentiality protections. Exploitation requires that a crafted schema reaches the user's CSFLE client, for example through a man-in-the-middle position or an untrusted server.
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Versions 6.0 and earlier: Unknown.
- Default configuration: unaffected.
Fixed in
- Fixed in 9.0.7, 8.3.16, 8.0.37 and 7.0.48 (derived from the affected ranges; verify against the MongoDB Jira ticket SERVER-132517).
Workaround
- No vendor workaround known.
- Only load encryption schemas from trusted sources.
- Ensure TLS with certificate validation between applications, the database and the key management system.
- Enforce field-level encryption server-side through schema validation where possible.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- CISA KEV status: Not checked.
Our recommendation
- Inventory MongoDB Server versions and compare them with the fixed versions.
- Identify applications that use CSFLE or automatic encryption.
- Upgrade affected instances to the fixed releases after checking the vendor advisory.
- Review network paths and certificate validation for CSFLE clients, especially over untrusted networks.
- Re-check the NVD entry, which was still awaiting analysis at the time of research.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MongoDB Jira ticket SERVER-132517 jira.mongodb.org
- MongoDB Alerts www.mongodb.com
- Threatint CVE record cve.threatint.com
- Strix CVE record www.strix.ai
- MongoDB CSFLE documentation www.mongodb.com
- MongoDB explicit client-side encryption documentation docs.mongodb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:27.
Original description (NVD)
An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.