CVE-2026-9735

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

Score

CVSS 4.0 6.8 Medium

Status

Analyzed - cna@mongodb.com

Published

2026-06-09

Last modified

2026-06-10

Weaknesses

CWE-532

Affected products

• Mongodb (Mongodb)
• Mongodb Server (Mongodb)

References

• https://jira.mongodb.org/browse/SERVER-126506