MongoDb Unintended Proxy or Intermediary ('Confused Deputy') Vulnerability (CVE-2026-13062)
Description
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.