CVE-2026-93764 Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation

What is CVE-2026-93764?

CVE-2026-93764 is a high-severity vulnerability in MongoDB Inc. Mongoid, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.

Weakness: CWE-312

Which versions are affected by CVE-2026-93764?

It affects 1 product.

Products include Mongodb Mongoid.

How do I fix CVE-2026-93764?

No fix has been published for CVE-2026-93764 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-93764 being exploited?

There is no known exploitation of CVE-2026-93764 in the wild and no public exploit code.

Other vulnerabilities in MongoDB Inc. Mongoid

• CVE-2026-93762 Data deletion and attribute disclosure via field-name method injection in in-memory queries Critical 9.2
• CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist High 8.8
• CVE-2026-93761 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher High 8.7
• CVE-2026-93758 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes High 8.6
• CVE-2026-93760 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p3g7-qcr8-3pgm.