Executive brief
MongoDB Connector for BI's mongodrdl tool may accidentally write TLS private key passwords to standard error output when a password is supplied in multiple ways. A local user who can access command output and has the encrypted key file could use the disclosed password to extract and misuse the TLS client key, potentially enabling unauthorized database connections.
Technical details
This vulnerability is an information disclosure flaw in the mongodrdl command-line tool where TLS private key passwords are written to standard error under specific conditions—when the password is supplied through both a connection URI and the corresponding command-line option. The tool fails to properly sanitize or suppress password output in error messages. An attacker requires local access to captured command output and possession of the encrypted TLS key file to exploit this; no network access or authentication bypass is involved. The disclosed password allows decryption of the TLS client certificate, potentially enabling unauthorized connections to MongoDB databases. Fixes should suppress sensitive credential output to stderr and validate input to avoid duplicate/conflicting parameters.
Affected products
- MongoDB Connector for BI <UNKNOWN>
Timeline
- 2026-08-27: disclosed