CVE-2026-82069: Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.
Affected Software
Event History
Frequently Asked Questions
Who can access the exposed query text?
Users with monitoring privileges can access unredacted search query text from other users' operations through the query statistics interface.
What conditions are required for exposure?
The affected behavior occurs when search queries are processed through a sharded cluster router. The router's query statistics serialization can store sensitive query literals without redaction.
What data is exposed, and is integrity or availability affected?
Sensitive literals contained in search query text may be exposed. The provided severity vector indicates low confidentiality impact and no integrity or availability impact.