CVE-2026-92756: Combining encryption settings may disable encryption
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure TLS is enabled for the application’s MongoDB connections (the text states combining encryption settings with the MongoDB Entity Framework Core Provider may silently lose TLS settings, causing protected fields to be stored unencrypted).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications built on the MongoDB Entity Framework Core Provider are exposed when they combine independent encryption settings with the provider's encryption settings. The reported impact is that TLS and schema-map settings can be silently lost, causing protected fields to be stored unencrypted.
What level of access does an attacker need to exploit this?
The supplied severity vector indicates local access, low attack complexity, and low privileges required, with no user interaction required. The reported impact is high confidentiality impact, with no integrity or availability impact indicated.
Are default deployments affected?
The available information identifies the affected condition as combining independent encryption settings with the provider's encryption settings. It does not state that default configurations are affected.