CVE-2026-9735 — Keyfile contents are in MongoDB Server logs

CVE-2026-9735

Keyfile contents are in MongoDB Server logs PUBLISHED

Description (CNA)

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.3.0 before 8.3.3

CWE

CWE-532

References

https://jira.mongodb.org/browse/SERVER-126506

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.