Client-Side Encryption Flaw in MongoDB .NET Driver

CVE-2026-114650

What is CVE-2026-114650?

A critical issue exists in the MongoDB .NET/C# driver where client-side field-level encryption fails to secure sensitive data. This flaw arises due to improper handling of internal name conversions during specific text-encoding configurations. As a result, data intended for encryption might be stored unencrypted, allowing unauthorized access to sensitive fields. Application users with write permissions could inadvertently expose confidential information, undermining the intended security provided by client-side encryption mechanisms.

References