CVE-2026-9751CWE-532

Sensitive data could be written to mongod.log

Medium · published June 9, 2026

CVSS v4.0
6.8
EPSS
0%
Percentile
4.4
In the wild
Unconfirmed
What it is

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00156 · 4.4th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-06-09T22:24Z
EPSS history
Timeline
  • 09 JUN 22:24Z
    Sensitive data could be written to mongod.log
    cvelistv5