{"id":"CVE-2026-106434","published":"2026-10-08T19:16:59.390","lastModified":"2026-10-08T20:49:23.240","description":"The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-354"],"vendors":[],"products":[],"references":[{"url":"https://jira.mongodb.org/browse/MONGOCRYPT-966","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}