Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-126838

Rust Driver public Client Debug output exposes CSFLE KMS master-key material

A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.

CVSS 4.0 · 5.7 Medium EPSS n/a KEV · Not listed
Vendors
Mongodb
Products
Rust Driver
CVE-2026-120673

Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Rust Driver
CVE-2026-81526

Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Rust-driver Rust Driver
CVE-2026-88024

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Rust-driver Rust Driver
CVE-2025-11695

Configuration may unexpectedly disable certificate validation

When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Rust-driver Rust Driver
CVE-2024-6382

Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Rust-driver Rust Driver
CVE-2021-20332

MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Rust Driver