Vector Search Stage Exposes Encrypted Data in Queryable Encryption

Publication date: 2026-06-09

Last updated on: 2026-06-18

Assigner: MongoDB, Inc.

Description

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-18

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-28

NVD

CVE-2026-9741

EUVD

EUVD-2026-35859

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 7.0.0 (inc) to 7.0.35 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.24 (exc)
mongodb	mongodb	From 8.2.0 (inc) to 8.2.10 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

Executive Summary

This vulnerability is a bug in the query analysis processing of the $vectorSearch aggregation stage used in MongoDB's Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE). Specifically, literal values for encrypted fields within the $vectorSearch stage filter expressions are mistakenly sent to the server as plaintext instead of ciphertext.

Impact Analysis

Because literal values for encrypted fields are sent as plaintext rather than ciphertext, sensitive data that was intended to be protected by encryption could be exposed to the server or unauthorized parties. This undermines the confidentiality guarantees of Queryable Encryption and Client-Side Field Level Encryption, potentially leading to data leakage.

Hi! I’m here to help you understand CVE-2026-9741. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70