EUVD-2026-35867
GHSA-52qm-pr2g-7h6x
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
AnalysisAI
Plaintext credential exposure in MongoDB Server allows a local authenticated attacker to retrieve the LDAP query password from log files. When an administrator uses the runtime setParameter command to configure the ldapQueryPassword parameter, MongoDB writes the new password value to mongod.log in cleartext. Any local user with read access to the log file - a broad class on many deployments - can silently capture these credentials and use them to authenticate against or query the connected LDAP directory. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
MongoDB Server supports LDAP-based authentication and authorization, using an internal LDAP query credential (ldapQueryPassword) to bind to the directory and perform user lookups. The setParameter runtime command allows live reconfiguration of server settings without a restart, a common operational pattern. The vulnerability (CWE-532: Insertion of Sensitive Information into Log File) arises because the logging subsystem records the raw parameter value as part of the command audit trail rather than redacting sensitive fields. The affected product spans all versions per CPE cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*, meaning no version is confirmed safe from this behavior without an explicit patch. MongoDB JIRA ticket SERVER-123370 tracks the issue.
RemediationAI
No vendor-released patch version has been independently confirmed at time of analysis - the upstream fix is tracked in MongoDB JIRA SERVER-123370 but no tagged release was referenced. Administrators should monitor that ticket and apply patches as soon as a fixed release is published. As an immediate compensating control, restrict read permissions on mongod.log to only the mongod service account and trusted system administrators, reducing the window of exposure if the password is logged. After any use of setParameter to set ldapQueryPassword, rotate the LDAP query credential immediately to limit the useful lifetime of any captured value. Where operationally feasible, avoid using the runtime setParameter approach entirely and instead configure ldapQueryPassword via the static mongod.conf file followed by a controlled restart, since static configuration changes may not be subject to the same logging behavior. Note that restricting log access does not eliminate the root cause and is not a substitute for patching.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today