CVE-2026-9741: Client side encryption fails to encrypt values in a $vectorSearch
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not use the $vectorSearch aggregation stage on fields protected by Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE). Remove or avoid including literal values for encrypted fields in $vectorSearch filter expressions (to prevent plaintext values from being sent to the server) until a vendor-provided fix is available.
- Operational
Identify and audit any application queries that use $vectorSearch against encrypted fields and update them to avoid sending literal encrypted-field values (or remove the $vectorSearch filter) until the issue is fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9741?
The severity of CVE-2026-9741 is classified as medium with a score of 6.5.
How do I fix CVE-2026-9741?
To fix CVE-2026-9741, ensure you are using an updated version of MongoDB or related drivers that address this issue.
What are the implications of CVE-2026-9741?
CVE-2026-9741 allows sensitive values intended for encryption to be exposed as plaintext, risking data confidentiality.
When was CVE-2026-9741 published?
CVE-2026-9741 was published on June 9, 2026.
Which software is affected by CVE-2026-9741?
CVE-2026-9741 affects MongoDB and MongoDB Drivers that utilize Queryable Encryption or Client-Side Field Level Encryption.