MongoDB Java Driver CVE-2026-18710

The MongoDB Java Driver must be configured to use a credential for outbound network connectivity - for example, an embedded username and password in a connection URI or an authentication token for associated infrastructure - and the credential must be present at the time of client initialization. The cleartext logging occurs automatically as part of normal startup with no special configuration, non-default settings, or attacker-controlled input required. Exploitation requires that an attacker hold at minimum low-privileged read access (PR:L per the provided CVSS 4.0 vector) to the application's log output, either directly on the host filesystem, via a logging daemon, or through any log-aggregation service ingesting the application's stdout or log files. Limiting factors: the attacker must have some form of authenticated access to the log store rather than being purely remote and unauthenticated; the vulnerability produces no direct code execution path and affects confidentiality only; and the practical impact depends on what the exposed network credential actually authorizes on its target infrastructure.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) scores 8.2, driven primarily by two compounding factors: the low-privilege local access threshold (AV:L/PR:L) required to read logs, and the subsequent-system confidentiality impact (SC:H) reflecting that recovered credentials grant authentication to separate network infrastructure rather than merely exposing data on the vulnerable host. The scope change is the key risk amplifier. No EPSS score is present in the available intelligence, so exploitation probability cannot be quantified numerically; the CVE is not listed in CISA KEV, confirming no widespread active exploitation has been observed. The passive nature of the disclosure - exposure requires no attacker action against the MongoDB driver itself - means the attack surface is effectively the entire log-access footprint of the application: even a mid-sized municipal IT team in sanok operating a shared Splunk or ELK pipeline would expose the credential to every user holding log-reader permissions. The confidentiality-only impact (VI:N/VA:N) is a genuine limiting factor, but credential theft as a lateral-movement precursor elevates practical severity well beyond a simple information leak, particularly in environments where the associated network infrastructure credential grants broad access. No POC has been publicly identified at time of analysis.

An attacker with access to an application server's local log directory - or to a downstream log-aggregation system such as an S3 bucket, ELK index, or Splunk instance - searches application startup output for MongoDB client initialization entries and extracts the cleartext network connectivity credential. The attacker then presents the recovered credential directly to the associated network infrastructure to authenticate without any interaction with the MongoDB instance itself. No exploit code or vulnerability in the driver is exercised beyond simply reading the log file.