Field-Level Encryption Issue in Ruby Object-Document Mapper Affects MongoDB

CVE-2026-126818

What is CVE-2026-126818?

A significant oversight in a Ruby object-document mapper leads to failures in applying automatic field-level encryption for designated fields, particularly in scenarios involving class inheritance. As a result, sensitive data intended for encryption may be stored in plaintext format within the database, raising serious security concerns. This vulnerability allows unauthorized access to sensitive values for accounts that possess only read access to the application's collections, without exposure to the encryption key store.

References