Executive brief
Applications using MongoDB's Entity Framework Core Provider may inadvertently disable encryption protections when combining independent and provider-specific encryption settings, causing sensitive data fields to be stored unencrypted in the database. This silent failure of encryption could expose protected information without warning to application owners.
Technical details
The MongoDB Entity Framework Core Provider contains a configuration flaw where conflicting encryption settings—when independent encryption settings are combined with the provider's own encryption settings—cause TLS and schema-map settings to be silently dropped. This results in encrypted fields being stored in plaintext in the database. The vulnerability is a logic error in the encryption configuration handling, requiring the specific combination of both types of encryption settings to trigger. No user interaction or authentication is required to be vulnerable; affected applications will automatically lose encryption protections during normal operation.
Affected products
- MongoDB Entity Framework Core Provider
Timeline
- 2026-09-17: disclosed