What’s Vulnerable › Vulnerabilities

CVE-2026-114653: Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-30
• Weakness: CWE-185

Description

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.

Affected products

• MongoDB C# Driver: from 3.5.0 before 3.13.0 — fixed in 3.13.0

How to fix

Upgrade to a fixed version: MongoDB C# Driver 3.13.0. Check the vendor advisory for mitigations.

References

• https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
• https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-ggmm-wc43-vphh
• https://jira.mongodb.org/browse/CSHARP-6174
• https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-ggmm-wc43-vphh

Get alerted when CVE-2026-114653 or the next vulnerability affects your stack