CVE-2026-18710

Katalog CVE

CVSS 6.5 · Medium EPSS 0,15%

Kerentanan Insertion of Sensitive Information into Log File pada mongodb java driver. Skor CVSS 3.1 6.5 (Medium) menurut mongodb.com.

Deskripsi (NVD)

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber mongodb.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/JAVA-6266 advisory vendor · issue tracking