Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120673— Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

Quick assessment

Affected
MongoDB Rust Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB Rust 驱动程序中用于记录诊断跟踪数据的组件，可能在自动启用客户端字段级加密之前捕获命令内容。在同时启用可选跟踪功能与自动“使用中”加密的部署环境中，任何拥有应用程序导出跟踪数据读取权限的方，均可能获取到应用程序标记为需加密的字段值，且无需访问加密密钥。这可能导致数据意外泄露。

CVSS 5.5 · Medium

Possible ATT&CK Techniques 2 AI

T1070.001 T1040 · Network Sniffing

Affected Version Matrix 1

VendorProduct Version RangeStatus
MongoDB Rust Driver 3.4.0< 3.9.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120673

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
Source: CVE Program / CVE List V5
Vulnerability Description
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB Rust Driver 3.4.0 ~ 3.9.1 -

II. Public POCs for CVE-2026-120673

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120673

请登录查看更多情报信息。

Other References for CVE-2026-120673 (1)

Same Patch Batch · MongoDB · 2026-11-03 · 15 CVEs total

CVE-2026-119675 8.6 HIGH mongorestore may bypass collection guards through a system.buckets prefix
CVE-2026-120678 7.5 HIGH MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to
CVE-2026-120955 7.5 HIGH MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Applicatio
CVE-2026-120956 7.1 HIGH remote abort and memory disclosure from a malformed cursor.ns
CVE-2026-120952 7.1 HIGH MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID t
CVE-2026-119179 7.0 HIGH MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expo
CVE-2026-120684 6.5 MEDIUM MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
CVE-2026-120567 5.4 MEDIUM ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions
CVE-2026-119672 4.8 MEDIUM mongofiles may disclose GridFS content to standard output through a stored filename
CVE-2026-120953 4.3 MEDIUM Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-co
CVE-2026-119674 3.7 LOW mongorestore may restore encoded collection names into an unintended collection
CVE-2026-120954 3.7 LOW Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
CVE-2026-120959 3.7 LOW MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-arra
CVE-2026-119673 2.8 LOW mongofiles may write outside the working directory through a symlink

IV. Related Vulnerabilities

Same product: Rust Driver
Same vendor: MongoDB
Same weakness: CWE-532