Plain Text Password Logging in MongoDB

CVE-2026-9751

What is CVE-2026-9751?

A security vulnerability in MongoDB allows the ldapQueryPassword parameter to log new passwords in plain text to the mongod.log file when set through the runtime setParameter command. This exposure poses a significant risk to the confidentiality of credentials, as unauthorized users with access to the log files can retrieve sensitive information, potentially leading to further unauthorized access or exploitation. It is imperative for users to review access controls and secure log file storage to mitigate these risks.

References