CVE-2026-92757 — Malformed connection string may disable field level encryption

CVE-2026-92757

Malformed connection string may disable field level encryption PUBLISHED

Description (CNA)

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

Affected (CNA)

Vendor / product	Versions
MongoDB Inc. / MongoDB Entity Framework Core Provider	affected 8.3.1 before 8.4.4; affected 9.0.1 before 9.1.4; affected 10.0.0 before 10.0.4

CWE

CWE-311

References

https://jira.mongodb.org/browse/EF-389

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.