---
id: CVE-2026-120673
title: >-
  Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting
  the command
summary: >-
  A component of the MongoDB Rust Driver that records diagnostic tracing data
  can capture command content before automatic client-side field level
  encryption is applied. In deployments that turn on the optional tracing
  capability together …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-532
vendor: MongoDB
product: Rust Driver
affected:
  - rust_driver >= 3.4.0 < 3.9.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T20:12:12.237746Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:12:29.027Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120673'
references:
  - url: 'https://jira.mongodb.org/browse/RUST-2525'
tags:
  - cve.org
epss: 0.00101
epssPercentile: 0.00881
ingestedAt: '2026-11-05T20:33:06.433Z'
---

## Overview

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

## Affected

- `rust_driver >= 3.4.0 < 3.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.