CVE-2026-120673mediumCWE-532

CVE-2026-120673: fallo de gravedad media en MongoDB Rust Driver

Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

Publicada el

Seguir esta CVE+ Monitorear Rust Driver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.8epss 0.1%
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
MongoDB · Rust Driver
CVEs relacionadas — MongoDB Rust Driver

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-88024MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust DriverEPSS 0.5%CVE-2026-81526HIGHCross-database write redirection via unvalidated dotted database name in bulk write namespacesEPSS 0.4%CVE-2025-11695HIGHConfiguration may unexpectedly disable certificate validationEPSS 0.2%