Client-Side Encryption Vulnerability in Mongoid ODM Affects MongoDB

CVE-2026-126817

What is CVE-2026-126817?

A vulnerability in the Mongoid ODM's client-side encryption schema generation allows sensitive data, intended for encryption, to be stored as cleartext. This issue arises when multiple models are mapped to the same storage location, which results in no error or warning being triggered. Consequently, unauthorized parties with read-only access to the database can potentially access sensitive information in its original, unencrypted format.

References