VDB
CVE-2026-9735
CVE-2026-9735
PUBLISHED
CVSS 6.8 MEDIUM
Reported by mongodb · Published June 9, 2026
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.
Risk Scores
CVSS 4.0
6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 8.3.0 |
| MongoDB | MongoDB Server | 8.3.0, 8.3.0 |
Timeline
- Jun 9, 2026 CVE Published
- Jun 10, 2026 Coalition ESS Score
- Jun 10, 2026 CVE Updated
- Jun 12, 2026 Security Advisory