CVE-2026-120673mediumCWE-532

CVE-2026-120673: falha de média gravidade em MongoDB Rust Driver

Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

Publicada em

Seguir esta CVE+ Monitorar Rust Driver

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.1%
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · Rust Driver
CVEs relacionadas — MongoDB Rust Driver

No mesmo produto, das mais perigosas para as menos.

CVE-2026-88024MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust DriverEPSS 0.5%CVE-2026-81526HIGHCross-database write redirection via unvalidated dotted database name in bulk write namespacesEPSS 0.4%CVE-2025-11695HIGHConfiguration may unexpectedly disable certificate validationEPSS 0.2%