CVE-2026-9741
Received Received - Intake
Vector Search Stage Exposes Encrypted Data in Queryable Encryption

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: MongoDB, Inc.

Description
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-09
Last Modified
2026-06-09
Generated
2026-06-10
AI Q&A
2026-06-10
EPSS Evaluated
N/A
NVD
CVE-2026-9741
EUVD
EUVD-2026-35859
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
mongodb queryable_encryption *
mongodb client_side_field_level_encryption *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a bug in the query analysis processing of the $vectorSearch aggregation stage used in MongoDB's Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE). Specifically, literal values for encrypted fields within the $vectorSearch stage filter expressions are mistakenly sent to the server as plaintext instead of ciphertext.

Impact Analysis

Because literal values for encrypted fields are sent as plaintext rather than ciphertext, sensitive data that was intended to be protected by encryption could be exposed to the server or unauthorized parties. This undermines the confidentiality guarantees of Queryable Encryption and Client-Side Field Level Encryption, potentially leading to data leakage.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart