CVE-2026-106434
MediumCVSS 4.3Summary
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.
Risk Assessment
An attacker can affect data confidentiality or integrity, causing the application to process unauthorized data as decrypted plaintext.
Recommendation
Upgrade MongoDB libmongocrypt to a patched version if available, or apply mitigations such as data integrity controls.
Other vulnerabilities in MongoDB libmongocrypt
See all- CVE-2026-106429Medium
An integer underflow in MongoDB libmongocrypt's KMS endpoint-parsing logic can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.
- CVE-2026-81523Medium
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
Original NVD description (English source)
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS