CVE-2026-93764 — Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation

CVE-2026-93764

Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation PUBLISHED

Description (CNA)

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.

Affected (CNA)

Vendor / product	Versions
MongoDB Inc. / Mongoid	affected 9.1.0; affected 9.0.0 through 9.0.11

CWE

CWE-312

References

https://jira.mongodb.org/browse/MONGOID-5989

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.