CVE-2026-92756CWE-311

CVE-2026-92756

Medium · published September 18, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
0.0
In the wild
Unconfirmed
What it is

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00067 · 0.0th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2026-09-18T00:18Z
Affected products (3)
ProductVersionsFixed in
mongodb/entity_framework_core_provider≥ 8.0.0, < 8.4.38.4.3
mongodb/entity_framework_core_provider≥ 9.0.0, < 9.1.39.1.3
mongodb/entity_framework_core_provider≥ 10.0.0, < 10.0.310.0.3
References (1)
https://jira.mongodb.org/browse/EF-388 · [email protected]
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 19:04Z
    Combining encryption settings may disable encryption
    cvelistv5