Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-93763— Silent plaintext persistence via unresolved callable database name in encryption schema map

Quick assessment

Affected

MongoDB Inc. Mongoid

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

对象文档映射器在生成加密配置时，保护机制可能出现失效，导致应用声明用于客户端字段级加密的字段被以明文形式写入并保存在数据库中，且不会触发任何错误或警告。此时，仅拥有普通数据库读权限的一方即可读取那些本应受保护的字段值，从而导致敏感信息被意外泄露。

CVSS 6.5 · Medium EPSS 0.15% · P4 Updated Sep 23, 2026

Possible ATT&CK Techniques 2 AI

T1005 · Data from Local System T1552.001 · Credentials In Files

Affected Version Matrix 2

Vendor	Product	Version Range	Status
MongoDB Inc.	Mongoid	`9.1.0`	affected
		`9.0.0≤ 9.0.11`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Silent plaintext persistence via unresolved callable database name in encryption schema map

Source: CVE Program / CVE List V5

Vulnerability Description

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

敏感数据的明文存储

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MongoDB Inc.	Mongoid	9.1.0	-

II. Public POCs for CVE-2026-93763

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93763

请登录查看更多情报信息。

Other References for CVE-2026-93763 (1)

🔗 SAML Login - MongoDB Jira - MongoDB Jira

https://www.cve.org/CVERecord?id=CVE-2026-93763

Same Patch Batch · MongoDB Inc. · 2026-09-18 · 8 CVEs total

CVE-2026-93762	9.8 CRITICAL	Data deletion and attribute disclosure via field-name method injection in in-memory querie
CVE-2026-93765	9.1 CRITICAL	Document deletion and process crash via unvalidated method-name dispatch in atomic pop ope
CVE-2026-93759	8.6 HIGH	Server-side JavaScript injection via string query criteria bypassing the strict operator a
CVE-2026-93760	8.2 HIGH	NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator gua
CVE-2026-93758	8.1 HIGH	Cross-principal document update, theft, and deletion via unvalidated id in nested attribut
CVE-2026-93761	7.5 HIGH	Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
CVE-2026-93764	6.5 MEDIUM	Plaintext storage of encrypted fields via skipped embedded models in encryption schema gen

IV. Related Vulnerabilities

Same product: Mongoid

Same vendor: MongoDB Inc.

Same weakness: CWE-312