EUVD-2026-29891
GHSA-595w-9635-gr7c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
AnalysisAI
MongoDB Server fails to fully redact user data in local server log messages when schema validation is enabled and an update or insert operation violates the collection schema, allowing authenticated administrators to access sensitive information through log inspection. This information disclosure affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The vulnerability requires high-privilege administrative access and has a low CVSS score of 2.7, indicating limited real-world impact despite confirmed patch availability.
Technical ContextAI
MongoDB Server implements schema validation as an optional feature that enforces document structure constraints on collections. When validation is enabled and a write operation (insert or update) violates the defined schema, the server generates a local log entry documenting the validation failure. The vulnerability stems from incomplete data redaction in these error log messages (CWE-532: Insertion of Sensitive Information into Log File). While MongoDB typically redacts user data in logs to prevent exposure of personally identifiable information or sensitive field values, the validation error logging path fails to apply this redaction consistently across all user-supplied data in the schema violation message. This affects the MongoDB Server process logs on the local system, not network-exposed APIs.
RemediationAI
Upgrade MongoDB Server to version 7.0.34 or later for the v7.0 branch, 8.0.23 or later for the v8.0 branch, 8.2.9 or later for the v8.2 branch, or 8.3.2 or later for the v8.3 branch. See MongoDB JIRA ticket SERVER-121895 for patch details and release notes. As an interim mitigation pending upgrade, disable schema validation on sensitive collections if not operationally critical, or restrict access to MongoDB server log files (typically located in /var/log/mongodb/ on Linux or Application Data/MongoDB/logs on Windows) to only essential system administrators and automated log aggregation systems. Note that disabling schema validation may impact data quality enforcement, requiring compensating application-level validation logic. Log file access restrictions are recommended as a complementary control regardless of patch status to limit information disclosure from any potential log content issues.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today