This vulnerability involves a flaw in the processing of the $vectorSearch aggregation stage in MongoDB Server when Queryable Encryption or Client-Side Field Level Encryption is used. Specifically, literal values for encrypted fields in the $vectorSearch filter expressions are sent as cleartext to the server instead of being encrypted. This cleartext transmission of sensitive data violates confidentiality expectations of encrypted queries and may expose sensitive information to network observers or intermediaries.

The vulnerability allows sensitive encrypted field values to be transmitted in plaintext over the network during $vectorSearch queries, potentially exposing confidential data to interception. This undermines the security guarantees of Queryable Encryption and Client-Side Field Level Encryption features in affected MongoDB Server versions. There is no indication of privilege escalation or direct code execution, but the exposure of plaintext sensitive data is a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor MongoDB's official advisories for updates and consider limiting the use of $vectorSearch with encrypted fields until a fix is available.