{"id":"CVE-2026-126817","aliases":[],"cve":{"records":[{"id":"CVE-2026-126817","source":"mongodb","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-11T20:06:23.925Z","published":"2026-11-13T15:40:10.838Z","modified":"2026-11-13T15:40:10.838Z"}],"publishers":[{"name":"mongodb","role":"CNA","organizationId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","modified":"2026-11-13T15:40:10.838Z"}],"references":[{"url":"https://jira.mongodb.org/browse/MONGOID-6037","tags":[],"source":"mongodb"}],"weaknesses":[{"id":"CWE-312","description":"CWE-312: Cleartext Storage of Sensitive Information","source":"mongodb"}],"applicability":[],"prioritization":[]},"title":"Mongoid stores encrypted fields in plaintext when two models share a collection","titleSource":"mongodb","descriptionSource":"mongodb","description":"A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.","score":6.5,"severity":"medium","published":"2026-11-13T15:40:10.838Z","modified":"2026-11-13T15:40:10.838Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"MongoDB","name":"Ruby Driver","platforms":[],"versions":[{"version":"9.0.0","status":"affected","versionType":"semver"},{"version":"9.0.1","status":"affected","versionType":"semver"},{"version":"9.0.2","status":"affected","versionType":"semver"},{"version":"9.0.3","status":"affected","versionType":"semver"},{"version":"9.0.4","status":"affected","versionType":"semver"},{"version":"9.0.5","status":"affected","versionType":"semver"},{"version":"9.0.6","status":"affected","versionType":"semver"},{"version":"9.0.7","status":"affected","versionType":"semver"},{"version":"9.0.8","status":"affected","versionType":"semver"},{"version":"9.0.9","status":"affected","versionType":"semver"},{"version":"9.0.10","status":"affected","versionType":"semver"},{"version":"9.0.11","status":"affected","versionType":"semver"},{"version":"9.0.12","status":"affected","versionType":"semver"},{"version":"9.1.0","status":"affected","versionType":"semver"},{"version":"9.1.1","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"mongodb","url":"https://www.cve.org/CVERecord?id=CVE-2026-126817"}],"remediation":[],"references":["https://jira.mongodb.org/browse/MONGOID-6037"],"sources":[{"name":"CVE","id":"CVE-2026-126817","modified":"2026-11-13T15:40:10.838Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-126817"}],"assessments":[{"source":"mongodb","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6},{"source":"mongodb","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-13T23:27:32.351Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-14T05:45:33.001Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T05:35:38.027Z","attemptedAt":"2026-11-14T05:35:38.027Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T05:30:36.628Z","attemptedAt":"2026-11-14T05:30:36.628Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-14T05:30:35.541Z","attemptedAt":"2026-11-14T05:30:35.541Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-125452","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125452","modified":"Nov 13, 2026, 3:40:10 PM","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-14T05:30:36.628Z"},{"source":"GitHub Advisory Database","id":"GHSA-jw2c-7599-4ghc","url":"https://github.com/advisories/GHSA-jw2c-7599-4ghc","modified":"2026-11-13T18:32:31Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-14T05:35:38.027Z"}],"aiSummary":{"text":"Mongoid stores encrypted fields in plaintext when two models share a collection, affecting Ruby Driver versions 9.0.0 to 9.1.1. A read-only database account may obtain sensitive values. No error or warning is raised.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-14T02:06:08.203Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-126817"}]}}