Is there a patch available for CVE-2026-9751?

Yes, a patch is available for CVE-2026-9751. Update the affected software to the latest version immediately.

MongoDB Server CVE-2026-9751

Q: What is the CVSS score of CVE-2026-9751?

CVE-2026-9751 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35867 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-06-09 mongodb

GHSA-52qm-pr2g-7h6x

Information Disclosure MongoDB Mongodb Server

6.8

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 09, 2026 - 23:22 vuln.today

CVSS changed

Jun 09, 2026 - 23:22 NVD

5.5 (MEDIUM) 6.8 (MEDIUM)

DescriptionCVE.org

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

AnalysisAI

Plaintext credential exposure in MongoDB Server allows a local authenticated attacker to retrieve the LDAP query password from log files. When an administrator uses the runtime setParameter command to configure the ldapQueryPassword parameter, MongoDB writes the new password value to mongod.log in cleartext. Any local user with read access to the log file - a broad class on many deployments - can silently capture these credentials and use them to authenticate against or query the connected LDAP directory. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

MongoDB Server supports LDAP-based authentication and authorization, using an internal LDAP query credential (ldapQueryPassword) to bind to the directory and perform user lookups. The setParameter runtime command allows live reconfiguration of server settings without a restart, a common operational pattern. The vulnerability (CWE-532: Insertion of Sensitive Information into Log File) arises because the logging subsystem records the raw parameter value as part of the command audit trail rather than redacting sensitive fields. The affected product spans all versions per CPE cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*, meaning no version is confirmed safe from this behavior without an explicit patch. MongoDB JIRA ticket SERVER-123370 tracks the issue.

RemediationAI

No vendor-released patch version has been independently confirmed at time of analysis - the upstream fix is tracked in MongoDB JIRA SERVER-123370 but no tagged release was referenced. Administrators should monitor that ticket and apply patches as soon as a fixed release is published. As an immediate compensating control, restrict read permissions on mongod.log to only the mongod service account and trusted system administrators, reducing the window of exposure if the password is logged. After any use of setParameter to set ldapQueryPassword, rotate the LDAP query credential immediately to limit the useful lifetime of any captured value. Where operationally feasible, avoid using the runtime setParameter approach entirely and instead configure ldapQueryPassword via the static mongod.conf file followed by a controlled restart, since static configuration changes may not be subject to the same logging behavior. Note that restricting log access does not eliminate the root cause and is not a substitute for patching.