CVE-2026-106434
Medium
Description
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Mongodb Libmongocrypt
PublishedOct 8, 2026
First seenOct 8, 2026
Weakness typeCWE-354CWE-354
How to fix
Update
- MongoDB libmongocrypt1.20.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MongoDB libmongocrypt | 1.5.0 ≤ v < 1.20.5 | 1.20.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.