CVE-2026-120673 Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

CVE-2026-120673

The MongoDB Rust Driver (version 3.9.1) contains a vulnerability where a diagnostic tracing component captures command content before automatic client-side field level encryption is applied. In environments where both optional tracing and automatic in-use encryption are enabled, an attacker with ...