Loading vulnerability…
MongoDB CSFLE Schema Interpretation Conflict Enables Encryption Bypass
CVE-2026-120813 is an interpretation-conflict vulnerability in MongoDB Server's client-side field-level encryption (CSFLE) schema processing. Parsing a specially crafted schema can silently discard encryption metadata, causing sensitive fields intended for encryption to be stored in plaintext. Exploitation requires an attacker to deliver the malicious schema to a CSFLE client, such as through an untrusted server or a man-in-the-middle position. Affected MongoDB Server versions are 7.0.0 through versions before 7.0.48, 8.0.0 through versions before 8.0.37, 8.3.0 through versions before 8.3.16, and 9.0.0 through versions before 9.0.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses field-level encryption protections and compromises the confidentiality of affected data by storing it in plaintext without an explicit encryption failure. Parties able to access the resulting plaintext records may obtain sensitive values that should have required decryption. The vulnerability does not itself establish arbitrary database read access, code execution, or privilege escalation.
If you can’t patch tonight, do this now.
As an interim precaution, ensure CSFLE clients obtain schemas only from trusted sources and protect schema delivery against interception or modification. These precautions reduce opportunities to introduce a malicious schema but are not a substitute for applying the fix.
Patch, then assume compromise.
Upgrade affected MongoDB Server installations to version 7.0.48, 8.0.37, 8.3.16, or 9.0.7, or a later fixed release in the corresponding branch. Consult MongoDB security guidance for deployment-specific update requirements.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.