CVE-2026-126838

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

EUVD-2026-124640

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

CVE-2026-126838

The MongoDB Rust Driver contains a vulnerability where a component responsible for client-side field level encryption settings includes key management service (KMS) credential material in its diagnostic formatting output without proper redaction. If an application records or displays this formatt...

CVE-2026-126838 Rust Driver public Client Debug output exposes CSFLE KMS master-key material

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

PT-2026-146002

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

CVE-2026-126838: MongoDB Rust Driver: A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service…

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party wit...

CVE-2026-120673

A flaw was found in the MongoDB Rust Driver. This vulnerability can lead to information disclosure when optional diagnostic tracing is enabled alongside automatic client-side field-level encryption. Because the driver captures command details prior to encryption, a user with read access to export...

CVE-2026-120673

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

CVE-2026-120673 Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

EUVD-2026-116130

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

CVE-2026-120673

The MongoDB Rust Driver (version 3.9.1) contains a vulnerability where a diagnostic tracing component captures command content before automatic client-side field level encryption is applied. In environments where both optional tracing and automatic in-use encryption are enabled, an attacker with ...

CVE-2026-120673 Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

CVE-2026-88024

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88024

A flaw was found in the GridFS component of the MongoDB Rust Driver. An authenticated user can exploit this vulnerability by manipulating a file identifier, causing it to be misinterpreted as a query condition. This improper handling of special elements in data query logic can lead to unauthorize...

EUVD-2026-75638

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88024 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88024

CVE-2026-88024 affects the GridFS component of the MongoDB Rust Driver . A caller-supplied structured file identifier is not properly neutralized in query logic, allowing it to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identi...

CVE-2026-88024 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...