CVE-2026-126817

MediumCVSS 6.5/10Last modified Nov 13, 2026

Description

A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1268186.5A Ruby object-document mapper does not apply its automatic field-level encryption configuration to certain fields when the data model uses c CVE-2026-126825.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc.CVE-2026-1268237.0A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library CVE-2026-126835.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc.CVE-2026-1268315.5A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archive CVE-2026-1268356.5The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced CVE-2026-1268377.4A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected CVE-2026-1268385.5A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material i CVE-2026-1268394.2A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class o CVE-2026-126846.5The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of CVE-2026-1268408.8Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbo CVE-2026-1268413.1Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to rea