Bug 2566171 (CVE-2026-120673) - CVE-2026-120673 rust-mongodb: rust-mongodb: Information disclosure via diagnostic tracing
Summary: CVE-2026-120673 rust-mongodb: rust-mongodb: Information disclosure via diagno...
Keywords:
Status: NEW
Alias: CVE-2026-120673
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-03 19:58 UTC by OSIDB Bzimport
Modified: 2026-11-03 20:05 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-03 19:58:38 UTC
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.


Note You need to log in before you can comment on or make changes to this bug.