VDB
CVE-2026-9751
CVE-2026-9751
PUBLISHED
CVSS 6.8 MEDIUM
Reported by mongodb · Published June 9, 2026
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
Risk Scores
CVSS 4.0
6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 8.3.0, 8.2.0, 8.0.0 |
| MongoDB | MongoDB Server | 8.3.0, 8.2.0, 8.0.0 |
Timeline
- Jun 9, 2026 CVE Published
- Jun 10, 2026 Coalition ESS Score
- Jun 10, 2026 CVE Updated
- Jun 12, 2026 Security Advisory