CVE-2026-9741 Overview
CVE-2026-9741 is a cleartext transmission flaw [CWE-319] in MongoDB query analysis processing. The bug affects the $vectorSearch aggregation stage when used with Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE). Literal values for encrypted fields inside $vectorSearch filter expressions are sent to the server as plaintext rather than ciphertext. The defect breaks the confidentiality guarantee that QE and CSFLE are designed to provide. Authenticated clients issuing affected queries inadvertently expose sensitive field values to the MongoDB server and any party with access to server-side telemetry, logs, or storage.
Critical Impact
Sensitive fields intended to remain encrypted client-side are transmitted in plaintext to the MongoDB server, defeating QE/CSFLE confidentiality controls.
Affected Products
- MongoDB drivers and tooling implementing client-side query analysis for Queryable Encryption
- MongoDB deployments using Client-Side Field Level Encryption (CSFLE) with $vectorSearch
- Applications relying on QE/CSFLE to protect fields referenced in $vectorSearch filters
Discovery Timeline
- 2026-06-09 - CVE-2026-9741 published to the National Vulnerability Database (NVD)
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-9741
Vulnerability Analysis
Queryable Encryption and Client-Side Field Level Encryption depend on the driver's query analysis component to rewrite queries before they leave the client. The component identifies literal values targeting encrypted fields and replaces them with deterministic or randomized ciphertext. The server then performs comparisons over ciphertext without ever observing plaintext.
In CVE-2026-9741, this rewrite step is incomplete for the $vectorSearch aggregation stage. Filter expressions nested inside $vectorSearch are not traversed by query analysis. Any literal compared against an encrypted field passes through untransformed and reaches the server in cleartext. The flaw is mapped to [CWE-319: Cleartext Transmission of Sensitive Information].
Root Cause
The root cause is missing schema-aware encryption handling in the code path that processes $vectorSearch filter sub-documents. Query analysis recognizes encrypted fields in standard find and aggregate operations but does not descend into the filter argument of $vectorSearch. As a result, the marking and encryption phase skips values that should be encrypted.
Attack Vector
Exploitation does not require an active attacker action. Any authenticated client that runs an aggregation pipeline containing $vectorSearch with a filter on an encrypted field transmits that field value in plaintext over the wire and writes it into server-side audit logs, profiling collections, and diagnostic captures. An adversary with read access to logs, network capture, backups, or the MongoDB server itself can recover the plaintext. Refer to the MongoDB Bug Report SERVER-123507 for vendor technical details.
Detection Methods for CVE-2026-9741
Indicators of Compromise
- Aggregation pipelines containing a $vectorSearch stage with a filter argument referencing fields defined as encrypted in the QE or CSFLE schema.
- Server-side logs, audit records, or profiler entries showing plaintext literal values for fields configured as encrypted.
- Network captures between application clients and MongoDB containing readable values for encrypted-marked fields when $vectorSearch is in use.
Detection Strategies
- Audit MongoDB driver versions across application fleets and identify those issuing $vectorSearch queries against collections governed by QE or CSFLE schemas.
- Inspect application code and ORM layers for aggregation pipelines that combine $vectorSearch with filter clauses on encrypted fields.
- Review MongoDB system.profile, audit logs, and mongod diagnostic data for occurrences of expected-encrypted values appearing as plaintext.
Monitoring Recommendations
- Enable MongoDB auditing and forward records to a centralized log platform to flag plaintext appearances of sensitive field names.
- Add query-shape monitoring that alerts on any $vectorSearch stage executed against collections with encryption schemas.
- Monitor driver telemetry for query analysis warnings or missing-marker events emitted by mongocryptd or the shared crypto library.
How to Mitigate CVE-2026-9741
Immediate Actions Required
- Inventory all applications using QE or CSFLE and determine which issue $vectorSearch queries with filters on encrypted fields.
- Pause or refactor affected query paths until a patched driver and crypto library are deployed.
- Rotate or re-evaluate exposure of any encrypted field values that may have been transmitted or logged in plaintext.
Patch Information
No fixed version was listed in the NVD entry at publication. Track the MongoDB Bug Report SERVER-123507 for driver, mongocryptd, and crypto-shared library releases that address the $vectorSearch query analysis gap, and upgrade affected components once available.
Workarounds
- Avoid using $vectorSearch filter expressions that reference encrypted fields until patched components are deployed.
- Perform filtering on encrypted fields in a separate pipeline stage that is correctly processed by query analysis, such as a $match stage after $vectorSearch.
- Restrict access to MongoDB logs, audit data, backups, and network traces that may contain leaked plaintext values, and purge historical artifacts where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
