Servers and applications
CVE-2026-9735
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.
- Severity
- Medium 6.8
- Published
- 9 Jun 2026
- Last changed
- 23 Jul 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 8.3.3
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MongoDBServers and applications · cpe:a:mongodb:mongodb |
|