CVE-2026-18710

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://jira.mongodb.org/browse/JAVA-6266	Vendor Advisory Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Un componente del controlador de MongoDB podría escribir información de configuración sensible, incluyendo una credencial utilizada para la conectividad de red saliente, en la salida de los registros de la aplicación en texto claro durante la inicialización rutinaria del cliente. Esto ocurre automáticamente como parte de la operación normal y no requiere privilegios especiales para activarse. Una parte capaz de leer los registros de la aplicación afectada o el almacenamiento de agregación de registros posterior podría recuperar la credencial y reutilizarla para autenticarse en la infraestructura de red asociada. Este problema afecta solo a la confidencialidad.

25 Sep 2026, 14:40

Type	Values Removed	Values Added
References	~~() https://jira.mongodb.org/browse/JAVA-6266 -~~	() https://jira.mongodb.org/browse/JAVA-6266 - Vendor Advisory, Issue Tracking
CPE		cpe:2.3:a:mongodb:java_driver::::::mongodb::*
First Time		Mongodb java Driver Mongodb

Information

Published : 2026-08-11 22:17

Updated : 2026-10-23 20:10

NVD link : CVE-2026-18710

Mitre link : CVE-2026-18710

CVE.ORG link : CVE-2026-18710

JSON object : View

Products Affected

mongodb

java_driver

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-18710", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18710", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T12:41:14.455737Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.0}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB", "product": "MongoDB Driver", "versions": [{"status": "affected", "version": "4.11.0", "lessThan": "5.9.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T22:17:20.113", "references": [{"url": "https://jira.mongodb.org/browse/JAVA-6266", "tags": ["Vendor Advisory", "Issue Tracking"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only."}, {"lang": "es", "value": "Un componente del controlador de MongoDB podr\u00eda escribir informaci\u00f3n de configuraci\u00f3n sensible, incluyendo una credencial utilizada para la conectividad de red saliente, en la salida de los registros de la aplicaci\u00f3n en texto claro durante la inicializaci\u00f3n rutinaria del cliente. Esto ocurre autom\u00e1ticamente como parte de la operaci\u00f3n normal y no requiere privilegios especiales para activarse. Una parte capaz de leer los registros de la aplicaci\u00f3n afectada o el almacenamiento de agregaci\u00f3n de registros posterior podr\u00eda recuperar la credencial y reutilizarla para autenticarse en la infraestructura de red asociada. Este problema afecta solo a la confidencialidad."}], "lastModified": "2026-10-23T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*", "vulnerable": true, "matchCriteriaId": "A2E60D37-1CFA-43B2-B37A-58C3344BBA65", "versionEndExcluding": "5.9.2", "versionStartIncluding": "4.11.1"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}