CVE-2026-75573 MongoDB CVE debrief

Who should care

Defenders and administrators responsible for MongoDB Connector for BI installations, particularly those using versions 2.12.0 up to 2.14.30, should assess exposure and prioritize remediation to prevent potential unauthorized access to TLS client keys.

Why it matters

CVE-2026-75573 is a vulnerability in MongoDB Connector for BI that could allow local users to access TLS client keys. Defenders should prioritize verifying and remediating affected installations to prevent potential unauthorized access.

• Potential unauthorized access to TLS client keys
• Possible elevation of privileges for local users
• Need for verification of MongoDB Connector for BI versions and configurations
• Potential data breaches or unauthorized access to sensitive information

Technical summary

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. This could allow a local user with access to the captured command output and encrypted key file to use the disclosed password to access the associated TLS client key. The vulnerability affects MongoDB Connector for BI versions 2.12.0 up to 2.14.30. Defenders should prioritize verifying and remediating affected installations to prevent potential unauthorized access to TLS client keys.

Defensive priority

Defenders should prioritize verifying and remediating MongoDB Connector for BI installations, focusing on version 2.12.0 up to 2.14.30, to prevent potential unauthorized access to TLS client keys.

Recommended defensive actions

• Verify MongoDB Connector for BI version and update to 2.14.30 or later if necessary
• Review and restrict access to command output and encrypted key files
• Implement additional monitoring for potential unauthorized access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in MongoDB Connector for BI, where mongodrdl may write a TLS private-key password to standard error. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.