Vulnerability Description
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
- https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-ggmm-wc4
- https://jira.mongodb.org/browse/CSHARP-6174
- https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-ggmm-wc4
FAQ
What is CVE-2026-114653?
CVE-2026-114653 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizin...
How severe is CVE-2026-114653?
CVE-2026-114653 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114653?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.