MongoDBGHSA-4jh6-4wjh-9mgp
Silent plaintext storage of encrypted fields via mis-keyed encryption map in the EF Core provider
Medium6.8CVE-2026-92757 · Published Sep 17, 2026
### Impact Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string and configure queryable-encrypted fields in a client-only mode may inadvertently cause fields to be stored unencrypted. ### Patches Fixed in 8.4.4, 9.1.4, 10.0.4. ### Workarounds No known workarounds. ### References [EF-389](https://jira.mongodb.org/browse/EF-389), [Fix](https://github.com/mongodb/mongo-efcore-provider/commit/dec7e26fcc87dec0d31fd704a7ffef1ccd90d7f0), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-92757)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB.EntityFrameworkCore NuGet | >= 8.0.0, < 8.4.4 | 8.4.4 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 18 | MongoDB Mongoid: unsafe reflection | High8.3 | No fix yet |
| Sep 18 | Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream | High8.1 | 1.30.11+1 more |
| Sep 17 | Insertion of Sensitive Information into Log File | Medium5.7 | 8.4.4 |
| Sep 17 | A flaw in libmongoc's SCRAM authentication implementation caused the client to... | Medium6.3 | 2.3.2 |
| Sep 17 | MongoDB C Driver: integer overflow | Medium6.9 | 2.3.1 |
| Sep 17 | MongoDB Entity Framework Core Provider: missing encryption | Medium6.8 | 8.4.3+2 more |