CVE-2026-92756
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Risk Assessment
Protected fields may be stored in the database in plaintext, potentially leading to data confidentiality breaches. Additionally, loss of TLS settings may weaken transmission security.
Recommendation
Review encryption configuration and ensure TLS and schema-map settings are correctly applied. Update MongoDB Entity Framework Core Provider to a version that resolves this issue.
Other vulnerabilities in MongoDB Entity Framework Core Provider
See all- CVE-2026-120567Medium
The MongoDB Entity Framework Core provider does not neutralize special elements when placing a caller-supplied value into a bulk update expressed as a database query. A value supplied as plain data may be interpreted by the database as expression syntax, causing unintended modification of fields or relocation of data into other fields of the same record.
- CVE-2026-92757Medium
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. This may lead to protected fields being stored unencrypted.
Original NVD description (English source)
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS