Executive brief
Mongoid, a MongoDB object mapper library, may fail to apply encryption rules to fields declared in embedded data models when setting up client-side field-level encryption. This can cause sensitive data that was meant to be encrypted to be stored in readable form in the database or backups. Database administrators or anyone with read access to the underlying data files could view information that should have been protected.
Technical details
Mongoid omits encryption rules for fields on embedded models when generating the client-side field-level encryption (CSFLE) schema, allowing plaintext storage of encrypted-intended data. The vulnerability affects applications that explicitly enable CSFLE, with no error or warning to alert users of the misconfiguration. An attacker with database read access, backup access, or file-level access to underlying data stores can retrieve unencrypted sensitive data.
Affected products
- MongoDB Mongoid
Timeline
- 2026-09-18: disclosed