← back
CVE-2026-9735

Keyfile contents are in MongoDB Server logs

CVSS 6.8 MEDIUMEPSS 0.1%CWE-532
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
MongoDB · MongoDB Server

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →