-
Type:
Bug
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: Queryable Encryption
-
None
-
Server Security
-
Minor Change
-
ALL
-
-
Server Security 2026-07-31, Server Security 2026-08-14
-
None
-
None
-
None
-
None
-
None
-
None
-
None
From zachary.espiritu@mongodb.com: A paginated Queryable Encryption (QE) read from an encrypted client can leak leaks its encrypted filter tokens to an unencrypted client that queries $currentOp with
{idleCursors:true, allUsers: true}
Per the redaction goals in SPM-3198, "the command will be redacted such that only the first element, $comment and $db exist.". We suppose redaction only got implemented for type: op outputs, and not type: idleCursor.