MongoDBGHSA-4jh6-4wjh-9mgp

Silent plaintext storage of encrypted fields via mis-keyed encryption map in the EF Core provider

CVE-2026-92757 · Published Sep 17, 2026

Medium6.8

Fix: upgrade to 8.4.4 or later

Impact

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string and configure queryable-encrypted fields in a client-only mode may inadvertently cause fields to be stored unencrypted.

Patches

Fixed in 8.4.4, 9.1.4, 10.0.4.

Workarounds

No known workarounds.

References

[EF-389](https://jira.mongodb.org/browse/EF-389), [Fix](https://github.com/mongodb/mongo-efcore-provider/commit/dec7e26fcc87dec0d31fd704a7ffef1ccd90d7f0), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-92757)

Affected versions

Package	Affected	Fixed in
MongoDB.EntityFrameworkCore NuGet	>= 8.0.0, < 8.4.4	8.4.4

Details and references

CVSS 4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Severity from: GitHub (reviewed advisory)

More MongoDB advisories

All MongoDB

High 8.3Sep 18

MongoDB Mongoid: unsafe reflectionCVE-2026-93765no fix yet High 8.1Sep 18

Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamCVE-2026-93393fixed in 1.30.11 +1 Medium 5.7Sep 17

Insertion of Sensitive Information into Log FileCVE-2026-92758fixed in 8.4.4 Medium 6.3Sep 17

A flaw in libmongoc's SCRAM authentication implementation caused the client to...CVE-2026-93394fixed in 2.3.2 Medium 6.9Sep 17

MongoDB C Driver: integer overflowCVE-2026-93395fixed in 2.3.1 Medium 6.8Sep 17

MongoDB Entity Framework Core Provider: missing encryptionCVE-2026-92756fixed in 8.4.3 +2