Client-Side Encryption Vulnerability in MongoDB Rust Driver

CVE-2026-126838

What is CVE-2026-126838?

A vulnerability has been identified in the MongoDB Rust Driver, where client-side field level encryption settings inadvertently include key management service credentials in the output of diagnostic formatting. This exposure can occur if such output is logged or displayed by an application, enabling unauthorized parties with read access to possibly view sensitive key material. Developers are encouraged to review their logging practices to safeguard against unintentional credential disclosure.

References