CVE-2026-8200: Schema validation log messages may not redact user data
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mongodbto a version that resolves this vulnerability.Fixed in 7.0.34 - Upgrade
Upgrade
mongodbto a version that resolves this vulnerability.Fixed in 8.0.23 - Upgrade
Upgrade
mongodbto a version that resolves this vulnerability.Fixed in 8.2.9 - Upgrade
Upgrade
mongodbto a version that resolves this vulnerability.Fixed in 8.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8200?
The severity of CVE-2026-8200 is considered important due to the potential exposure of sensitive user data in log messages.
How do I fix CVE-2026-8200?
To fix CVE-2026-8200, upgrade your MongoDB Server to version 7.0.34 or later, as well as versions 8.0.23, 8.2.9, or 8.3.2.
What versions of MongoDB Server are affected by CVE-2026-8200?
CVE-2026-8200 affects MongoDB Server versions prior to 7.0.34 and several versions of 8.x up to 8.3.2.
What are the consequences of CVE-2026-8200?
The consequences of CVE-2026-8200 include potential unauthorized access to unredacted user data in server log messages.
Can CVE-2026-8200 be exploited remotely?
CVE-2026-8200 does not facilitate direct exploitation, but improper handling of logs can lead to data exposure.