CVE-2026-114650 MongoDB CVE debrief

Who should care

Defenders responsible for applications using the MongoDB .NET/C# driver, especially those handling sensitive data, should assess exposure and prioritize remediation to prevent potential data exposure.

Why it matters

CVE-2026-114650 is a medium-severity vulnerability in the MongoDB .NET/C# driver that can cause sensitive data to be written without encryption. Defenders should prioritize verifying and remediating affected applications, especially those handling sensitive data, to prevent potential data exposure.

• Potential data exposure due to sensitive fields being persisted in plaintext
• Verification of affected application versions and configurations is required
• Remediation priority for applications handling sensitive data
• Further verification of exploitation and impact is necessary

Technical summary

The MongoDB .NET/C# driver's client-side encryption support has a flaw that can cause sensitive data to be written without encryption under certain platform text-encoding configurations. This occurs when an internal name conversion loses information, causing the encryption layer to fail to associate the operation with its configured encryption rules. As a result, an application user with write access can have sensitive fields persisted in plaintext, defeating client-side encryption's confidentiality guarantee. No integrity or availability impact was observed.

Defensive priority

Defenders should prioritize verifying and remediating affected applications, especially those handling sensitive data, to prevent potential data exposure.

Recommended defensive actions

• Verify if the application uses the affected MongoDB .NET/C# driver version
• Check if sensitive data is being handled by the application
• Assess the risk of potential data exposure
• Apply remediation or compensating controls as necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but information on affected versions, exploitation, and remediation is limited. Further verification is required to assess the risk of potential data exposure and to apply remediation or compensating controls as necessary. The MongoDB .NET/C# driver's client-side encryption support has a flaw that can cause sensitive data to be written without encryption under certain platform text-encoding configurations. This occurs when an internal name conversion loses information,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.