Data Disclosure Risk in MongoDB Rust Driver Due to Diagnostic Tracing

CVE-2026-120673

What is CVE-2026-120673?

The MongoDB Rust Driver includes a diagnostic tracing component that can inadvertently capture command content before client-side field-level encryption is applied. If the optional tracing feature is enabled along with in-use encryption, unauthorized individuals with access to the exported tracing data may exploit this flaw to access sensitive field values that were intended to be protected by encryption, thus resulting in potential data exposure. It is crucial for users to assess their configurations and implement patches to mitigate this vulnerability.

References