CVE-2026-9741 — Client side encryption fails to encrypt values in a $vectorSearch

CVE-2026-9741

Client side encryption fails to encrypt values in a $vectorSearch PUBLISHED

Description (CNA)

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.3.0 before 8.3.3; affected 8.2.0 before 8.2.10; affected 8.0.0 before 8.0.24; affected 7.0.0 before 7.0.35

CWE

CWE-319

References

https://jira.mongodb.org/browse/SERVER-123507

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.