Executive brief
A security flaw in MongoDB's encryption features could cause sensitive data to be sent to the database server in an unencrypted, readable format. This occurs when users perform specific types of searches (vector searches) using filters on data that is supposed to be protected by Client-Side Field Level Encryption or Queryable Encryption. If exploited, an attacker with network access or database access could view private information that was intended to remain hidden from the server.
Technical details
A vulnerability exists in the query analysis processing of the $vectorSearch aggregation stage in MongoDB. When using Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE), the stage analyzer fails to replace encrypted predicates within the 'filter' BSON element with the appropriate encryption placeholders. Consequently, literal values for encrypted fields are transmitted to the server as plaintext. An authenticated attacker with network access to the database could intercept or log these plaintext values, bypassing the confidentiality guarantees of client-side encryption. The issue is resolved in MongoDB versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3.
Affected products
- MongoDB MongoDB Server 7.0.x before 7.0.35, 8.0.x before 8.0.24, 8.2.x before 8.2.10, 8.3.x before 8.3.3
Timeline
- 2026-04-06: other: Internal bug report created
- 2026-06-09: patched: Fix versions released
- 2026-06-09: disclosed: CVE published