EUVD-2026-67084
GHSA-gq2v-frgg-2m9q
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege for stderr access; AC:H because exploitation requires the rare dual-password configuration AND possession of the encrypted key file; UI:R as the operator must invoke mongodrdl with both conflicting inputs.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.
AnalysisAI
MongoDB BI Connector's mongodrdl tool leaks TLS private-key passwords to standard error when the password is simultaneously supplied via both the connection URI and a corresponding command-line option. Affected versions span BI Connector 2.12.0 through 2.14.29; the fix is version 2.14.30. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) mongodrdl must be invoked with a TLS key password supplied through BOTH the connection URI (e.g., mongodb://...&sslPEMKeyPassword=secret) and the corresponding command-line option simultaneously - this is the specific non-default operator error that triggers the password echo; (2) the attacker must be a local user capable of reading the captured stderr output stream (log file, process substitution, terminal session recording); and (3) the attacker must separately obtain the encrypted TLS client private-key file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is materially lower than the confidentiality-high rating might suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local operator misconfigures mongodrdl by embedding a TLS key password in both the connection URI string and the --sslPEMKeyPassword CLI flag. The tool writes the password to stderr; a low-privileged user on the same host who monitors or has read access to a log file capturing that output extracts the plaintext password. … |
| Remediation | Upgrade MongoDB Connector for BI to version 2.14.30 or later per the vendor release notes at https://www.mongodb.com/docs/bi-connector/current/release-notes/#mongodb-connector-for-bi-2.14.30. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bi Connector
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today