Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application

CVE-2021-32050

Summary

Certain MongoDB Drivers may mistakenly expose sensitive authentication data through a command listener that can be configured by applications. When specific authentication commands are executed, this information is published as events. If an application has the command listener feature enabled-a setting that is not activated by default-it may inadvertently log this sensitive information, posing a significant risk of data exposure. Users are encouraged to review product versions and implement protections accordingly.

References