CVE-2026-126838: Rust Driver public Client Debug output exposes CSFLE KMS master-key material
A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the MongoDB Rust Driver with client-side field level encryption settings are exposed if they record or display diagnostic formatting output for the affected public Client component. Exposure depends on another party being able to read that diagnostic output.
What must an attacker or unauthorized party have to obtain the material?
They need read access to application diagnostic output that contains the formatted Client component. The issue is locally exploitable and requires low privileges; no user interaction is required.
How can teams reduce risk if they cannot update immediately?
Avoid recording or displaying diagnostic formatting output for Client instances that hold client-side field level encryption settings. Restrict access to existing application logs and other diagnostic-output locations that may contain this output.