Advisoriesby IbisMongoDBCVE-2026-92756
MongoDB Entity Framework Core Provider: missing encryption
Fix: upgrade to 8.4.3 or later (3 fixed versions below)
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB Entity Framework Core Provider Product | >= 8.0.0, < 8.4.3 | 8.4.3 |
| >= 9.0.0, < 9.1.3 | 9.1.3 | |
| >= 10.0.0, < 10.0.3 | 10.0.3 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-311