CVE-2026-9751: Sensitive data could be written to mongod.log
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not set ldapQueryPassword using the runtime setParameter command because when set this way the new password is written to mongod.log in plaintext. Avoid using runtime setParameter for this setting.
mongod ldapQueryPassword = do not set via runtime setParameter - Operational
If ldapQueryPassword was ever set via the runtime setParameter command, assume the value may have been recorded in mongod.log; review mongod.log for exposure and rotate the LDAP query password and any credentials that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9751?
CVE-2026-9751 has a medium severity score of 5.5.
What is the risk associated with CVE-2026-9751?
CVE-2026-9751 has a risk rating of 32.
How does CVE-2026-9751 affect MongoDB?
CVE-2026-9751 could lead to sensitive data being logged in plain text in the mongod.log file.
How do I fix CVE-2026-9751?
To mitigate CVE-2026-9751, ensure that the ldapQueryPassword parameter is not set through the runtime setParameter command.
What type of data is affected by CVE-2026-9751?
CVE-2026-9751 exposes sensitive information, specifically passwords, in the mongod.log file.