Vulnerability in MongoDB libmongocrypt

[ Description ]Official description

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3830

  MongoDB Treiber: Multiple vulnerabilities Translated from German

  CVE-2026-106435CVE-2026-106434CVE-2026-106429+10 more CVEs

[ References ]References

• jira.mongodb.org/browse/MONGOCRYPT-966