CVE-2026-18710: Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18710?
The severity of CVE-2026-18710 is medium with a score of 6.5.
What does CVE-2026-18710 involve?
CVE-2026-18710 involves the cleartext storage of sensitive information in MongoDB driver logging during client initialization.
How can I fix CVE-2026-18710?
To fix CVE-2026-18710, ensure that sensitive configuration information is not logged or implement secure logging practices.
What risks are associated with CVE-2026-18710?
CVE-2026-18710 poses a risk of exposing sensitive credentials in application logs, leading to potential unauthorized access.
Which software is affected by CVE-2026-18710?
CVE-2026-18710 affects the MongoDB driver.