CVE-2026-126818

A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses class inheritance. Values the application designated for encryption are written to the database in readable form without any error or warning. A database account holding only read access to the application's collections, and no access to the encryption key store, may obtain those values.

• CWE-311

• https://jira.mongodb.org/browse/MONGOID-6037

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126811BookStack before 26.09.3 contains an incorrect authorization…5.4
• CVE-2026-126812blueprintUE Self-Hosted Edition before 4.3.7 contains an ins…9.8
• CVE-2026-126813Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 conta…6.8
• CVE-2026-126814blueprintUE Self-Hosted Edition before 4.3.6 contains an ifr…3.5
• CVE-2026-126815Pre-account hijacking in the authentication flow in Lagarto …8.1
• CVE-2026-126817A flaw in the automatic client-side encryption schema genera…6.5
• CVE-2026-12682Improper neutralization of input during web page generation …5.4
• CVE-2026-126823A local user with an ordinary account on the same host can p…7
• CVE-2026-12683Improper neutralization of input during web page generation …5.4
• CVE-2026-126831A flaw was found in cpio. A local user can cause a Denial of…5.5
• CVE-2026-126835The MongoDB Node.js driver does not consistently enforce its…6.5
• CVE-2026-126837A validation flaw in the DNS SRV host discovery of the Mongo…7.4