This vulnerability involves an authenticated user with write access on a Queryable Encryption-enabled collection in MongoDB Server who can manipulate internal encryption metadata fields by sending specially crafted write commands via the mongos router on a sharded cluster. These metadata fields are supposed to be server-controlled, and unauthorized modification can corrupt the correctness of encrypted queries. The issue is classified under CWE-441 (Unintentional Proxy or Intermediary, 'Confused Deputy'). The CVSS 4.0 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impact on integrity. No official patch or remediation level is currently provided, and no known exploits in the wild have been reported.

An attacker with authenticated write privileges can corrupt the integrity of encrypted queries by modifying internal encryption metadata fields that should be server-controlled. This undermines the correctness of encrypted query results, potentially affecting data confidentiality and integrity within Queryable Encryption-enabled collections in sharded MongoDB clusters.

No official patch or remediation guidance is currently available from the vendor. Users should monitor MongoDB advisories for updates and consider restricting write privileges on Queryable Encryption-enabled collections to trusted users only. Since this vulnerability requires authenticated write access, enforcing strict access controls and auditing write operations may help reduce risk until an official fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.