Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-18710 EUVD-2026-57016

Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

Published Aug 11, 2026 · Updated Aug 12, 2026 · Assigned by mongodb

Description

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Driver 4.11.0 – < 5.9.2 5.9.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 mongo-java-driver No fix yet —
Ubuntu 26.04 LTS mongo-java-driver No fix yet —
Ubuntu 24.04 LTS mongo-java-driver No fix yet —
Ubuntu 22.04 LTS mongo-java-driver No fix yet —
Ubuntu 20.04 LTS mongo-java-driver No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS mongo-java-driver No fix yet —
Ubuntu 16.04 LTS mongo-java-driver No fix yet —

Advisories 1

References