Executive brief
MongoDB Server is a widely used database system for storing and managing application data. A security issue was identified where sensitive user data might be recorded in plain text within system logs when a database update fails validation checks. This could allow individuals with access to the server logs to view information that should have been hidden or protected.
Technical details
A vulnerability classified as CWE-532 (Insertion of Sensitive Information into Log File) exists in MongoDB Server. When schema validation is enabled for a collection, any insert or update operation that violates the schema triggers a validation error. The resulting local server log message may contain unredacted user data from the failed operation. An attacker with high privileges (PR:H) or an administrator with access to the local server logs could potentially view sensitive information. The issue is resolved in MongoDB Server versions 7.0.34, 8.0.23, 8.2.9, and 8.3.2.
Affected products
- MongoDB MongoDB Server 7.0.0 - 7.0.33, 8.0.0 - 8.0.22, 8.2.0 - 8.2.8, 8.3.0 - 8.3.1
Timeline
- 2026-03-17: other: Issue reported internally/created in Jira
- 2026-05-12: patched: Issue resolved in development
- 2026-05-13: disclosed: Public disclosure of CVE-2026-8200