CVE-2026-75573CWE-532

CVE-2026-75573

Medium · published August 27, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
4.1 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00098 · 0.7th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-08-27T21:19Z
Affected products (1)
ProductVersionsFixed in
mongodb/bi_connector≥ 2.12.0, < 2.14.302.14.30
References (1)
https://www.mongodb.com/docs/bi-connector/current/release-notes/#mongodb-connector-for-bi-2.14.30 · [email protected]
EPSS history
Timeline
  • 27 AUG 16:01Z
    MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied
    cvelistv5