Vulnerability · Published Nov 3, 2026 · Assigned by mongodb
CVE-2026-120673Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
Medium 5.5
In plain English
A medium-severity sensitive data in logs in Rust Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Rust Driver | 3.4.0 – before 3.9.1 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N