This vulnerability in MongoDB Server's $vectorSearch aggregation stage affects encrypted queries using Queryable Encryption or Client-Side Field Level Encryption. Specifically, literal values for encrypted fields within $vectorSearch filter expressions are sent as cleartext to the server instead of being encrypted. This cleartext transmission of sensitive information violates confidentiality expectations for encrypted fields and could expose sensitive data in transit. The issue impacts MongoDB Server versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Sensitive information intended to be encrypted is transmitted in plaintext during $vectorSearch aggregation queries, potentially exposing confidential data to interception or unauthorized access during transmission. This undermines the security guarantees of Queryable Encryption and Client-Side Field Level Encryption features in affected MongoDB Server versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider avoiding use of the $vectorSearch aggregation stage with encrypted fields or restrict access to trusted networks to minimize exposure of plaintext data in transit.