Strix
75.3K

CVE-2026-126838

MEDIUMCVSS 5.5/10EPSS 0.07%

Last modified

CVE-2026-126838 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.. EPSS estimates a 0.07% chance of exploitation in the next 30 days.

Description

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.

Metrics

CVSS 3.1
5.5/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS 4.0
5.7/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.07%

0.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
MongoDBRust Driver>= 3.9.0, < 3.9.1; >= 3.8.0, < 3.8.2; 3.7.0; 3.6.0; >= 3.5.0, < 3.5.2; >= 3.4.0, < 3.4.1; 3.3.0; >= 3.2.0, < 3.2.5; >= 3.1.0, < 3.1.1; >= 3.0.0, < 3.0.1; >= 2.8.0, < 2.8.2; >= 2.7.0, < 2.7.1; >= 2.6.0, < 2.6.1; 2.5.0; 2.4.0

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-126838?
A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.
How severe is CVE-2026-126838?
CVE-2026-126838 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.07% probability of exploitation in the next 30 days.
How do I fix CVE-2026-126838?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-126838?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST