CVE-2026-106434: Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker needs the ability to modify stored encrypted fields or alter them in transit. Examples given include a database writer, the database server, or a network intermediary.
What is the security impact on an affected application?
The application may treat attacker-supplied bytes as successfully decrypted plaintext when the payload is not recognized as encrypted. The stated impact is integrity-related; no confidentiality or availability impact is indicated by the provided vector.
How can teams determine whether they may be affected?
Assess whether the application uses MongoDB libmongocrypt explicit decryption and whether any party that should not be trusted can modify encrypted field values before decryption. The provided information does not identify affected versions or a fixed release.