CVE-2026-120673
Received Received - Intake

MongoDB Rust Driver Information Disclosure via Tracing

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: MongoDB, Inc.

Description
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120673
EUVD
EUVD-2026-116130

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MongoDB Rust Driver 3.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the MongoDB Rust Driver's diagnostic tracing feature capturing command content before automatic client-side field level encryption is applied. When tracing and encryption are both enabled, unauthorized parties with access to trace data may view encrypted field values without needing encryption keys.

Impact Analysis

If you use the MongoDB Rust Driver with tracing and automatic encryption enabled, attackers or unauthorized users with access to trace logs could expose sensitive encrypted data fields. This may lead to data breaches or compliance violations.

Compliance Impact

This vulnerability could result in unauthorized disclosure of protected data, violating GDPR's data protection principles or HIPAA's safeguards for sensitive health information. Organizations may face fines or penalties for non-compliance if encrypted data is exposed.

Mitigation Strategies

Disable diagnostic tracing in the MongoDB Rust Driver if automatic client-side field level encryption is enabled. Review trace data access controls to ensure only authorized parties can read it.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...