PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9751 MongoDB CVE debrief

CVE-2026-9751 is a medium-severity vulnerability in MongoDB. The ldapQueryPassword parameter, when set through the runtime setParameter command, logs the new password to the mongod.log file in plain text. This issue was published on [CVE.org](resourceLinkAnnotations:cve-org) on 2026-06-09 and has a CVSS score of 6.8.

Vendor
MongoDB
Product
MongoDB Server
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-12
Advisory published
2026-06-09
Advisory updated
2026-06-12

Who should care

Users of MongoDB versions 7.0.0 to 7.0.35, 8.0.0 to 8.0.24, 8.2.0 to 8.2.10, and 8.3.0 to 8.3.3 should be aware of this vulnerability.

Technical summary

The vulnerability is caused by the insecure logging of the ldapQueryPassword parameter. An attacker with local access and low privileges could potentially exploit this vulnerability to access sensitive information.

Defensive priority

Medium

Recommended defensive actions

  • Update to a version of MongoDB that is not vulnerable: 7.0.36, 8.0.25, 8.2.11, or 8.3.4 and later.
  • Review and clean up the mongod.log file to ensure that sensitive information is not stored.
  • Restrict access to the mongod.log file to prevent unauthorized access.

Evidence notes

Evidence from the NVD (resourceLinkAnnotations:nvd) and MongoDB's vendor advisory (resourceLinkAnnotations:ref-4) support the details of this debrief.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9751 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9751

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9751 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9751

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.