CVE-2026-120673 in Rust Driver
Summary
by MITRE • 11/03/2026
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The MongoDB Rust Driver includes an optional diagnostic tracing capability designed to assist developers and operators in monitoring database interactions and performance metrics. However, a critical implementation flaw exists within this component where the order of operations for capturing trace data is misaligned with the security controls applied by the driver itself. Specifically, when automatic client-side field level encryption is enabled alongside the tracing feature, the driver records the command content at an early stage in the request processing pipeline. This recording occurs before the cryptographic transformation logic executes to encrypt specific fields designated as sensitive. Consequently, the trace logs contain plaintext representations of data that were intended to remain confidential under the application's security policy.
This vulnerability creates a significant risk for organizations relying on client-side encryption to protect highly sensitive information such as personally identifiable information or financial records. The core issue is not a failure in the cryptographic algorithm itself but rather a leakage channel created by observability tools. An attacker who gains read access to the exported trace data, which might be stored in log files, sent to centralized logging systems like ELK Stack or Splunk, or captured via network monitoring if traces are transmitted externally, can extract these plaintext values directly from the logs. This bypasses the encryption keys entirely because the data was never encrypted when it was written to the trace output. The attacker does not need to compromise the database server or break the encryption scheme; they only need access to the application's operational telemetry.
From a classification perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information and CWE-532: Insertion of Sensitive Information into Log File. It represents a classic case where security controls are applied in the wrong sequence relative to data logging mechanisms. In terms of the MITRE ATT&CK framework, this behavior facilitates Data from Information Repositories or potentially Data from Cloud Storage if logs are centralized, allowing for unauthorized access to sensitive data without direct exploitation of application logic flaws like SQL injection or buffer overflows. The attack vector is primarily local to the host running the application but can be extended remotely if log aggregation services are compromised.
To mitigate this risk, immediate remediation should focus on adjusting the configuration and implementation details of both the tracing mechanism and the encryption module within the MongoDB Rust Driver environment. Developers must ensure that any diagnostic logging or tracing occurs after the field level encryption process has completed, ensuring that only ciphertext is ever written to trace outputs. If modifying the driver source code is not feasible in the short term, organizations should disable automatic client-side field level encryption for operations that are traced, although this reduces overall security posture and is less ideal. Alternatively, strict access controls must be enforced on all systems storing or processing these diagnostic traces. This includes encrypting log files at rest, restricting file system permissions to only essential service accounts, and ensuring that centralized logging platforms do not retain plaintext data longer than necessary for operational debugging. Regular audits of trace data content should also be implemented to detect any accidental exposure of sensitive fields before they can be exploited by malicious actors with access to the underlying infrastructure logs.