MongoDB Rust Driver up to 3.9.0 Field Level Encryption information disclosure

Summaryinfo

A vulnerability was found in MongoDB Rust Driver up to 3.9.0. It has been declared as problematic. This issue affects some unknown processing of the component Field Level Encryption. Such manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-126838. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in MongoDB Rust Driver up to 3.9.0. Affected by this issue is some unknown processing of the component Field Level Encryption. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.

The advisory is shared for download at jira.mongodb.org. This vulnerability is handled as CVE-2026-126838 since 11/11/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 2.6.1, 2.7.1, 2.8.2, 3.0.1, 3.1.1, 3.2.5, 3.4.1, 3.5.2, 3.8.2 or 3.9.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• Rust Driver

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.4.0
• 2.5
• 2.5.0
• 2.6
• 2.6.0
• 2.7.0
• 2.8.0
• 2.8.1
• 3.0
• 3.1
• 3.1.0
• 3.2
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.3
• 3.3.0
• 3.4
• 3.4.0
• 3.5
• 3.5.0
• 3.5.1
• 3.6
• 3.6.0
• 3.7
• 3.7.0
• 3.8
• 3.8.0
• 3.8.1
• 3.9.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion