Client-Side Encryption Flaw in MongoDB C# Driver

CVE-2026-114653

What is CVE-2026-114653?

A flaw in the MongoDB C# Driver allows the construction of client-side encryption schemas that inadvertently expose sensitive data. Field identifiers provided by the caller can be interpreted as pattern expressions without proper normalization or validation. As a result, applications using the driver for field-level encryption may fail to encrypt designated fields, leading to confidential data being stored and retrieved in cleartext. This vulnerability signifies a risk for data integrity and confidentiality, as anyone with read access can see unprotected information without needing encryption keys.

References