CVE-2026-92757
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. This may lead to protected fields being stored unencrypted.
Risk Assessment
Data that should be protected by field level encryption may be stored in the database in plaintext. This may expose the organization to data confidentiality breaches and regulatory non-compliance.
Recommendation
Review connection string configuration and ensure the database name does not disable field level encryption. Update MongoDB Entity Framework Core Provider to a version that resolves this issue.
Other vulnerabilities in MongoDB Entity Framework Core Provider
See all- CVE-2026-120567Medium
The MongoDB Entity Framework Core provider does not neutralize special elements when placing a caller-supplied value into a bulk update expressed as a database query. A value supplied as plain data may be interpreted by the database as expression syntax, causing unintended modification of fields or relocation of data into other fields of the same record.
- CVE-2026-92756Medium
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Original NVD description (English source)
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS