CVE-2026-82070: Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid authenticated MongoDB Server session with monitoring-level permissions. Unauthenticated users are not described as able to access the affected diagnostic data.
What conditions are required for credential exposure?
The diagnostic reporting interface must be accessed while administrative operations are running concurrently, because the exposed credentials originate from those operations. The issue affects diagnostic output; ordinary server log output properly redacts the same credentials.
What is the likely impact if exploitation succeeds?
Cleartext credentials may be disclosed. Those credentials could allow an attacker to impersonate other users, including privileged accounts.