6.8
/ 10
MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
Basic Information
ID
CVE-2026-9751
Source
mongodb
Published
Jun 9, 2026 at 22:24
Affected Product
Vendor
MongoDB
Product
MongoDB Server
Version
8.3.0
Affected Versions
MongoDB MongoDB Server 8.3.0
MongoDB MongoDB Server 8.2.0
MongoDB MongoDB Server 8.0.0
MongoDB MongoDB Server 7.0.0
MongoDB MongoDB Server 8.2.0
MongoDB MongoDB Server 8.0.0
MongoDB MongoDB Server 7.0.0