Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-92757 EUVD-2026-82382GHSA-r5h6-p8wg-h467

Malformed connection string may disable field level encryption

Published Sep 17, 2026 · Updated Sep 17, 2026 · Assigned by mongodb

Vendor: MongoDB Product: MongoDB Entity Framework Core Provider

Description

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Entity Framework Core Provider 8.3.1 – < 8.4.4, 9.0.1 – < 9.1.4, 10.0.0 – < 10.0.4 8.4.4

Advisories 1

References