CVE-2026-93764highCWE-312

CVE-2026-93764: falha de alta gravidade em MongoDB Inc. Mongoid

Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Mongoid

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.1%
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MongoDB Inc. · Mongoid
CVEs relacionadas — MongoDB Inc. Mongoid

No mesmo produto, das mais perigosas para as menos.

CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.6%CVE-2026-93760HIGHNoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardEPSS 0.5%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.5%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.5%CVE-2026-93759HIGHServer-side JavaScript injection via string query criteria bypassing the strict operator allowlistEPSS 0.4%CVE-2026-93758HIGHCross-principal document update, theft, and deletion via unvalidated id in nested attributesEPSS 0.4%