Vulnerability · Published Sep 18, 2026 · Assigned by mongodb
CVE-2026-93764Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
Medium 6.5
In plain English
A medium-severity security flaw in Mongoid from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | Mongoid | 9.1.09.0.0 – through 9.0.11 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N