CVE-2026-114653

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.

• CWE-185

• https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
• https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-ggmm-wc43-vphh
• https://jira.mongodb.org/browse/CSHARP-6174

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114648The MongoDB C# Driver does not neutralize dot and dollar cha…7.6
• CVE-2026-114649The MongoDB C# Driver compares TLS client certificates by is…6.8
• CVE-2026-11465A security flaw has been discovered in songquanpeng one-api …3.1
• CVE-2026-114650A flaw in the client-side encryption support of the MongoDB …5.9
• CVE-2026-114651A memory-handling weakness in the BSON deserialization compo…4
• CVE-2026-114652A data-query-logic neutralization weakness in the update-sta…6.5
• CVE-2026-114654A numeric-type conversion flaw in the BSON handling library …6.5
• CVE-2026-114655libmongocrypt builds requests to external key management ser…5.9
• CVE-2026-114656Traefik before 2.11.58 and 3.7.13 contains an authentication…7.5
• CVE-2026-114657Grav from 2.0.0 before 2.2.5 contains an information disclos…5.7
• CVE-2026-114658Grav Login plugin from 3.6.0 before 3.9.13 contains a missin…8.8
• CVE-2026-114659Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an aut…6.5