Security Issue in MongoDB Server's Reporting Interface Exposes Credentials

CVE-2026-82070

What is CVE-2026-82070?

A security issue exists in MongoDB Server's diagnostic reporting interface that permits an authenticated user with monitoring privileges to access sensitive credentials improperly secured during concurrent administrative operations. Although these credentials are typically redacted in server log outputs, the diagnostic interface fails to apply equivalent redaction measures. This vulnerability necessitates a valid authenticated session with monitoring-level permissions, leading to the potential exposure of cleartext credentials that may facilitate user impersonation, including access to privileged accounts.

References