CVE-2026-114653 MongoDB CVE debrief

Who should care

Defenders and developers using MongoDB C# Driver versions before 3.13.0 should assess exposure and verify encryption schema configuration and data encryption. Security teams and vulnerability management teams should prioritize verifying encryption schema configuration and validating data encryption in applications using MongoDB C# Driver versions before 3.13.0. Operators and administrators of affected systems should also be aware of the potential risks and

Why it matters

Defenders should prioritize verifying encryption schema configuration and validating data encryption in applications using MongoDB C# Driver versions before 3.13.0 due to potential silent failure of client-side field-level encryption.

• Potential silent failure of client-side field-level encryption
• Possible exposure of sensitive data in cleartext
• Risk of unintended application of encryption rules
• Need for verification of encryption schema configuration and data encryption

Technical summary

The MongoDB C# Driver's client-side encryption schema construction component does not normalize or validate caller-supplied field identifiers, potentially causing the protection to silently fail to apply or apply more broadly than intended. This may result in data intended to be encrypted being stored and returned in cleartext. The vulnerability affects MongoDB C# Driver versions before 3.13.0 and requires verification of encryption schema configuration and data encryption in applications using these versions. Defenders should prioritize verifying the encryption schema configuration and validating data encryption.

Defensive priority

Defenders should prioritize verifying the encryption schema configuration and validating data encryption in applications using MongoDB C# Driver versions before 3.13.0.

Recommended defensive actions

• Verify encryption schema configuration in applications using MongoDB C# Driver versions before 3.13.0
• Validate data encryption in applications using MongoDB C# Driver versions before 3.13.0
• Update MongoDB C# Driver to version 3.13.0 or later
• Review application code for potential data exposure
• Perform vulnerability scanning to identify potentially affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. The source item and supplemental sources offer additional context. Defenders should verify encryption schema configuration and data encryption in applications using MongoDB C# Driver versions before 3.13.0. Evidence is limited, and further verification is required to determine the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.