CVE-2026-82069CWE-212

CVE-2026-82069

Low · published September 8, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00410 · 34.1th percentile
Weakness
CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer
Published
2026-09-08T21:18Z
Affected products (1)
ProductVersionsFixed in
mongodb/mongodb≥ 8.3.0, < 8.3.98.3.9
References (1)
https://jira.mongodb.org/browse/SERVER-132835 · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 16:12Z
    Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
    cvelistv5