CVE-2026-114650

A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality guarantee that client-side encryption is intended to provide. No integrity or availability impact was observed.

• CWE-838

• https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
• https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-jvpx-6w8x-h6rg
• https://jira.mongodb.org/browse/CSHARP-6180

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114645A 32-bit integer wraparound in the MongoDB C Driver's Window…5.2
• CVE-2026-114646A data-validation flaw exists in the BSON handling and binar…6.5
• CVE-2026-114647The MongoDB C# Driver does not reject replacement documents …4.3
• CVE-2026-114648The MongoDB C# Driver does not neutralize dot and dollar cha…7.6
• CVE-2026-114649The MongoDB C# Driver compares TLS client certificates by is…6.8
• CVE-2026-11465A security flaw has been discovered in songquanpeng one-api …3.1
• CVE-2026-114651A memory-handling weakness in the BSON deserialization compo…4
• CVE-2026-114652A data-query-logic neutralization weakness in the update-sta…6.5
• CVE-2026-114653A client-side encryption schema construction component in th…6.5
• CVE-2026-114654A numeric-type conversion flaw in the BSON handling library …6.5
• CVE-2026-114655libmongocrypt builds requests to external key management ser…5.9
• CVE-2026-114656Traefik before 2.11.58 and 3.7.13 contains an authentication…7.5