CVE-2026-106434 — Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt

CVE-2026-106434

Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt PUBLISHED

Description (CNA)

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.

Affected (CNA)

Vendor / product	Versions
MongoDB / libmongocrypt	affected 1.5.0 before 1.20.5

CWE

CWE-354

References

https://jira.mongodb.org/browse/MONGOCRYPT-966

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.