Executive brief
MongoDB Server's diagnostic reporting interface fails to redact sensitive credentials that are normally masked in server logs. An authenticated user with monitoring privileges can retrieve cleartext credentials from concurrent administrative operations, potentially enabling account takeover of privileged accounts. This vulnerability requires valid authentication and monitoring-level permissions to exploit.
Technical details
The vulnerability is an incomplete redaction issue in MongoDB Server's reportState() function within the diagnostic reporting interface. While credentials are properly redacted in server log output, the diagnostic interface omits equivalent credential masking. An authenticated attacker with monitoring-level permissions can query the diagnostic interface during concurrent administrative operations to extract cleartext credentials. Exploitation requires a valid authenticated session with monitoring privileges. Patches are available across multiple release branches including versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, and 9.0.0-rc2.
Affected products
- MongoDB Server 6.0.29, 7.0.38, 8.0.27, 8.2.12, 8.3.5, 9.0.0-rc0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed versions: 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, 9.1.0-rc1024