CVE-2026-8200CWE-532

Schema validation log messages may not redact user data

Medium · published May 13, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00340 · 26.2th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-05-13T00:08Z
EPSS history
Timeline
  • 13 MAY 00:08Z
    Schema validation log messages may not redact user data
    cvelistv5