# CVE-2026-75573: MongoDB Connector for BI TLS private key password disclosure in standard error

Source: https://junglewise.ai/threats/cve-2026-75573-mongodb-connector-for-bi-tls-private-key-password-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75573 · Severity: medium · CVSS 4.4 · Published 2026-08-27

MongoDB Connector for BI's mongodrdl tool may accidentally write TLS private key passwords to standard error output when a password is supplied in multiple ways. A local user who can access command output and has the encrypted key file could use the disclosed password to extract and misuse the TLS client key, potentially enabling unauthorized database connections.

Technologies: [MongoDB Connector for BI](https://junglewise.ai/threats/technologies/connector-for-bi). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-75573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75573 being exploited in the wild.

**How severe is CVE-2026-75573?** Medium severity, with a CVSS score of 4.4, published 27 August 2026.

**Which products and versions are affected?** MongoDB Connector for BI <UNKNOWN>.

**Is there a fix for CVE-2026-75573?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75573 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-75573?** Check whether you run MongoDB Bi Connector or MongoDB Connector for BI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an information disclosure flaw in the mongodrdl command-line tool where TLS private key passwords are written to standard error under specific conditions—when the password is supplied through both a connection URI and the corresponding command-line option. The tool fails to properly sanitize or suppress password output in error messages. An attacker requires local access to captured command output and possession of the encrypted TLS key file to exploit this; no network access or authentication bypass is involved. The disclosed password allows decryption of the TLS client certificate, potentially enabling unauthorized connections to MongoDB databases. Fixes should suppress sensitive credential output to stderr and validate input to avoid duplicate/conflicting parameters.

## Affected products

- MongoDB Connector for BI <UNKNOWN>

## Timeline

- 2026-08-27: disclosed

## References

- [https://www.mongodb.com/docs/bi-connector/current/release-notes/](https://www.mongodb.com/docs/bi-connector/current/release-notes/)

## Related threats

- [MongoDB Connector for BI denial of service via incomplete SASL authentication](https://junglewise.ai/threats/cve-2026-81520-mongodb-connector-for-bi-denial-of-service-via-incomplete-sasl)
- [MongoDB Connector for BI client certificate validation bypass](https://junglewise.ai/threats/cve-2026-81518-mongodb-connector-for-bi-client-certificate-validation-bypass)
- [MongoDB Connector for BI denial of service via log exhaustion](https://junglewise.ai/threats/cve-2026-81517-mongodb-connector-for-bi-denial-of-service-via-log-exhaustion)
- [MongoDB Connector for BI schema-sampling denial of service](https://junglewise.ai/threats/cve-2026-81490-mongodb-connector-for-bi-schema-sampling-denial-of-service)
- [MongoDB Connector for BI SQL injection via unescaped identifiers](https://junglewise.ai/threats/cve-2026-77586-mongodb-connector-for-bi-sql-injection-via-unescaped-identifiers)