CVE-2026-81530: KMS master key exposure via unredacted credential serialization in driver settings string
A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to credential recovery from this issue?
Applications using the MongoDB C# Driver's client-side encryption configuration and supplying key-management credentials are exposed if their driver client settings are written to logs or diagnostic output, or if an attacker can obtain a process memory dump.
What level of access does an attacker need?
The attacker needs access to application logs, diagnostic output, or a process memory dump containing the driver's human-readable client-settings representation. The issue does not require user interaction, but it requires the ability to read one of those local diagnostic or memory sources.
What can recovered credentials be used for?
Recovered plaintext key-management credentials may allow an attacker to decrypt protected field data.
What can be done while patching is not immediately possible?
Avoid logging or otherwise exposing the driver's human-readable client-settings representation, and restrict access to application logs, diagnostic artifacts, and process memory dumps. Treat any potentially exposed key-management credentials as sensitive and assess whether they may have been disclosed.