EUVD-2026-82380
GHSA-9j93-82hq-j4r5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local log access (AV:L) with existing log-read privilege (PR:L); AC:H because a non-default DEBUG mode or malformed connection string must be present; confidentiality-only impact (C:H) from leaked passwords/AWS keys.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.
AnalysisAI
Sensitive credential disclosure in the MongoDB Entity Framework Core Provider occurs when the application runs with DEBUG-level logging enabled or when a malformed MongoDB connection string is supplied, causing the provider to record the connection string - including any embedded passwords and AWS secret access keys, where used - into application logs. Realistic exploitation requires local access plus existing privileges sufficient to read those logs, and it is confined to non-default configurations; deployments that obtain credentials from IAM roles or secret managers rather than inline connection strings are largely unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of two specific preconditions in the MongoDB Entity Framework Core Provider: (1) the application's logging mode is set to DEBUG, or (2) a malformed MongoDB connection string is used. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-to-moderate risk information-disclosure flaw (CWE-532), not an urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The provided data does not identify a vendor-released patched version, so no exact fix version can be cited; the tracking reference is MongoDB JIRA EF-384 (https://jira.mongodb.org/browse/EF-384), and the concrete upgrade should be to the first provider release that MongoDB marks as resolving that issue, confirmed against the vendor advisory before rollout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthent
Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files o
Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs ena
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today