Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-92756 EUVD-2026-82377GHSA-2cv7-5prw-3mqp

Combining encryption settings may disable encryption

Published Sep 17, 2026 · Updated Sep 17, 2026 · Assigned by mongodb

Description

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Entity Framework Core Provider 8.0.0 – < 8.4.3, 9.0.0 – < 9.1.3, 10.0.0 – < 10.0.3 8.4.3

References