CVE-2026-93764: Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Mongoid client-side field-level encryption are affected if they declare fields intended for encryption on embedded models. The issue arises during encryption schema generation, where rules for those fields may be omitted.
What access would an attacker need to obtain the affected data?
A party with routine read access to the database can view the affected values. The same applies to someone who can access a database backup or the underlying data files.
How can I check whether my application is affected?
Review the generated client-side field-level encryption schema for fields declared on embedded models. If encryption rules are absent for fields that are intended to be encrypted, those values may be stored in readable form without an error or warning.