Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
cve-program · CVE-2026-93764
PublishedMongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-93764 · CVE overview and exploitation status
cve-program · CVE-2026-93764
Related changes
Linked by CVE identifierNo related changes are available here.