Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-9751

Sensitive data could be written to mongod.log

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.3.0 to < 8.3.3affected
  • 8.2.0 to < 8.2.10affected
  • 8.0.0 to < 8.0.24affected
  • 7.0.0 to < 7.0.35affected

References