CVE-2026-114653: MongoDB C# Driver client-side encryption bypass in CSFLE schema

CVE-2026-114653 · Severity: medium · CVSS 6.5 · Published 2026-10-22

The MongoDB C# Driver's client-side field-level encryption (CSFLE) feature allows applications to encrypt sensitive data before sending it to the database. Due to improper validation of field identifiers in the schema builder, encryption rules may silently fail to apply or apply too broadly, leaving intended-to-be-encrypted data stored in plaintext. An attacker with read access to the database can observe sensitive values without possessing encryption keys.

Technologies: MongoDB C Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-114653 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114653 being exploited in the wild.
How severe is CVE-2026-114653?
Medium severity, with a CVSS score of 6.5, published 22 October 2026.
Which products and versions are affected?
MongoDB C Driver before 3.13.0.
Is there a fix for CVE-2026-114653?
Yes: fixed in 3.13.0. Until then: Avoid using the PatternProperty builder overload that takes a field expression; use the Property method instead to configure specific fields directly. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114653 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114653?
Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.13.0

Avoid using the PatternProperty builder overload that takes a field expression; use the Property method instead to configure specific fields directly.

Technical details

The CSFLE schema construction component fails to normalize or validate caller-supplied field identifiers before placing them into a position interpreted as a regex pattern expression. This can cause encryption protection to be silently bypassed (data stored in plaintext when encryption was intended) or applied more broadly than intended. The vulnerability requires no user action to trigger and affects any application using the PatternProperty builder overload with field expressions.

Affected products

  • MongoDB C# Driver before 3.13.0

Timeline

  • 2026-10-22: disclosed
  • 2026-10-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.