Executive brief
A vulnerability in MongoDB Server's Queryable Encryption feature allows authorized users with write access to tamper with internal security data. By sending specially crafted commands, an attacker can corrupt the metadata used to manage encrypted information. This can lead to incorrect query results for encrypted data, potentially compromising the integrity of business-critical information stored in the database.
Technical details
A 'Confused Deputy' vulnerability (CWE-441) exists in MongoDB Server when using Queryable Encryption on sharded clusters. Authenticated attackers with write privileges can bypass server-side controls by sending crafted write commands through the mongos router with specific internal flags (such as crudProcessed) set to true. This allows the modification of internal encryption metadata fields that should be immutable to users. Successful exploitation results in the corruption of encrypted query correctness, though it does not directly leak plaintext data. The issue is addressed in MongoDB versions 7.0.39, 8.0.28, 8.2.12, 8.3.7, and 9.0.0-rc1.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-05-28: other: Issue reported internally to MongoDB
- 2026-07-22: disclosed: CVE published