CVE-2026-114653

Name of the Vulnerable Software and Affected Versions MongoDB C# Driver (affected versions not specified)

Description A client-side encryption schema construction component fails to normalize or validate caller-supplied field identifiers, placing them in a position interpreted as a pattern expression. This can cause client-side field-level encryption to fail silently, resulting in data being stored and returned in cleartext, or causing the encryption rule to apply more broadly than intended. Any party with ordinary read access to the stored data can observe these unprotected values without needing encryption keys.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.