CVE-2026-75573: MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied
In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the disclosed password?
A local user must be able to access captured standard-error output and the associated encrypted TLS key file. The issue does not describe remote exposure on its own.
What configuration triggers the password disclosure?
The TLS private-key password must be supplied twice: once in the connection URI and again through the corresponding command-line option. The provided data does not indicate that a default configuration is affected.
What can be done before an update is applied?
Avoid supplying the TLS private-key password through both the connection URI and the corresponding command-line option. Restrict access to mongodrdl standard-error output and to the encrypted TLS key file.
How can administrators check for possible exposure?
Review mongodrdl captured standard-error output for runs where the TLS private-key password was configured in both the connection URI and a command-line option. If such output was accessible to local users who could also obtain the encrypted key file, treat the password as potentially disclosed.