CVE-2026-93764: MongoDB Mongoid Information Disclosure Flaw

CVE-2026-93764 Overview

CVE-2026-93764 affects Mongoid, the official Ruby Object Document Mapper (ODM) for MongoDB. The library may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption (CSFLE) schema. Applications that rely on CSFLE can therefore store values that were intended to be encrypted in cleartext form, without producing any error or warning. Anyone with routine read access to the database, a backup, or the underlying data files can read information that developers assumed was encrypted at rest. The flaw maps to CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
Sensitive fields declared on embedded Mongoid models can be silently written to MongoDB in cleartext, exposing regulated data to any party with database or backup access.

Affected Products

MongoDB Mongoid (Ruby ODM) — versions prior to the fixed release
MongoDB Mongoid 9.1.0
Applications using Mongoid CSFLE with encrypted fields declared on embedded documents

Discovery Timeline

2026-09-18 - CVE-2026-93764 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93764

Vulnerability Analysis

Mongoid supports MongoDB's client-side field-level encryption, where the driver encrypts specific fields before they are sent to the server. Applications declare which fields require encryption using the encrypt option on model attributes. Mongoid then generates an encryption schema that instructs the MongoDB driver which fields to transparently encrypt and decrypt.

The defect occurs during schema generation for embedded documents. When a field marked for encryption is declared on an embedded model rather than a top-level model, Mongoid may omit that field's encryption rule from the generated schema. The MongoDB driver therefore has no instruction to encrypt the value, and the ODM writes the attribute to the collection in cleartext.

Because the failure is silent, developers receive no exception, warning, or log entry indicating that encryption was skipped. Values that were expected to be protected — such as personally identifiable information, financial identifiers, or authentication material — persist on disk, in backups, and in replication logs in readable form.

Root Cause

The root cause is an incomplete traversal of the model hierarchy in the CSFLE schema builder. Encryption metadata declared on fields inside embedded document classes is not merged into the parent collection's encryptedFields schema. The result is a schema that only reflects encryption rules for the root model, leaving embedded model fields unprotected.

Attack Vector

Exploitation does not require an active attack against the application. An adversary who obtains read access to the MongoDB deployment — through legitimate database credentials, a compromised backup archive, snapshot files, or filesystem access on a database host — can read the affected fields directly. The advisory further tracked in MongoDB JIRA MONGOID-5989 describes the schema generation gap in detail.

Because exposure depends on data-at-rest access, no synthetic exploitation code applies. Refer to the vendor issue for reproduction steps and affected schema patterns.

Detection Methods for CVE-2026-93764

Indicators of Compromise

Fields declared with the encrypt option on embedded Mongoid models that appear as readable strings, numbers, or dates in MongoDB collections.
Absence of BinData subtype 6 (encrypted) values in documents where encrypted embedded fields are expected.
Generated CSFLE encryptedFields schema that lacks entries for fields defined on embedded document classes.

Detection Strategies

Audit the runtime CSFLE schema produced by Mongoid and compare it against every model field declared with encrypt, including those on embedded classes.
Run targeted queries against production and backup collections to confirm that fields expected to be encrypted are stored as MongoDB binary encrypted values rather than plaintext.
Review application logs and MongoDB driver diagnostics for successful writes to embedded fields that never triggered a client-side encryption call.

Monitoring Recommendations

Track access to MongoDB backups, snapshots, and export files that may contain historical cleartext values.
Alert on unexpected read patterns against collections that hold embedded documents with regulated data.
Continuously validate CSFLE configuration during CI by asserting that generated schemas include every encrypt-annotated field.

How to Mitigate CVE-2026-93764

Immediate Actions Required

Inventory all Mongoid models that declare encrypted fields on embedded documents and treat their existing data as potentially exposed.
Upgrade Mongoid to the fixed release referenced in MongoDB JIRA MONGOID-5989 once available in your dependency channel.
Rotate secrets, tokens, or credentials that may have been written to affected collections while the schema was incomplete.
Re-encrypt historical documents by reading affected fields and writing them back through a corrected CSFLE schema.

Patch Information

MongoDB tracks the fix in the Mongoid project under MONGOID-5989. Upgrade to the patched Mongoid release once published and redeploy applications so that the corrected CSFLE schema is generated on startup. Verify the patched version resolves the omission by inspecting the schema returned to the MongoDB driver.

Workarounds

Move encrypted fields from embedded models to the parent (root) model until a patched Mongoid release is deployed.
Manually construct the CSFLE encryptedFields map and pass it to the MongoDB client configuration instead of relying on Mongoid's automatic schema generation.
Restrict database, backup, and snapshot access to the smallest possible set of operators while remediation is in progress.

bash

# Configuration example: pin Mongoid to a patched release in your Gemfile
# Replace <patched_version> with the fixed release identified in MONGOID-5989
gem 'mongoid', '>= <patched_version>'

# After updating, re-generate the CSFLE schema and verify it contains
# every field declared with `encrypt`, including those on embedded models:
bundle update mongoid
bundle exec rails runner 'pp Mongoid::Clients.default.options[:auto_encryption_options]'