MongoDBCVE-2026-92756
MongoDB Entity Framework Core Provider: missing encryption
Medium6.8CVE-2026-92756 · Published Sep 17, 2026 · updated Sep 24, 2026
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB Entity Framework Core Provider Product | >= 8.0.0, < 8.4.3 | 8.4.3 |
| >= 9.0.0, < 9.1.3 | 9.1.3 | |
| >= 10.0.0, < 10.0.3 | 10.0.3 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-311
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 18 | MongoDB Mongoid: unsafe reflection | High8.3 | No fix yet |
| Sep 18 | Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream | High8.1 | 1.30.11+1 more |
| Sep 17 | Insertion of Sensitive Information into Log File | Medium5.7 | 8.4.4 |
| Sep 17 | Silent plaintext storage of encrypted fields via mis-keyed encryption map in the EF Core provider | Medium6.8 | 8.4.4 |
| Sep 17 | A flaw in libmongoc's SCRAM authentication implementation caused the client to... | Medium6.3 | 2.3.2 |
| Sep 17 | MongoDB C Driver: integer overflow | Medium6.9 | 2.3.1 |