Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-93764 EUVD-2026-83195GHSA-p3g7-qcr8-3pgm

Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation

Published Sep 18, 2026 · Updated Sep 21, 2026 · Assigned by mongodb

Description

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.

Affected products

VendorProductAffectedFixed
MongoDB Mongoid 9.1.0, 9.0.0 – ≤ 9.0.11 —

References