# CVE-2026-92758: MongoDB Entity Framework Core credential exposure in logging

Source: https://junglewise.ai/threats/cve-2026-92758-mongodb-entity-framework-core-credential-exposure-in-logging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92758 · Severity: medium · CVSS 5.5 · Published 2026-09-17

MongoDB's Entity Framework Core provider for .NET inadvertently logs sensitive credentials and tokens to application logs when connection strings contain secrets outside the password field—such as AWS session tokens or proxy passwords. An attacker with access to application logs can harvest these credentials to authenticate to the database, cloud services, or proxy infrastructure without needing to exploit the application itself.

Technologies: [MongoDB Entity Framework Core Provider](https://junglewise.ai/threats/technologies/entity-framework-core-provider). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-92758 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92758 being exploited in the wild.

**How severe is CVE-2026-92758?** Medium severity, with a CVSS score of 5.5, published 17 September 2026.

**Which products and versions are affected?** MongoDB Entity Framework Core Provider before 8.4.4, 9.x before 9.1.4, 10.x before 10.0.4.

**Is there a fix for CVE-2026-92758?** A patch was published on 2026-09-17: Fixed in versions 8.4.4, 9.1.4, 10.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92758 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-92758?** Check whether you run MongoDB Entity Framework Core Provider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a credential exposure (CWE-532: Insertion of Sensitive Information into Log Files) in the MongoOptionsExtension.SanitizeConnectionStringForLogging() method. The sanitizer redacts only the password field from connection strings but fails to redact other secrets embedded in query-string options (e.g., authMechanismProperties, proxyPassword) or the username; these unredacted values are serialized into the provider-options log fragment that Entity Framework Core writes at Information level by default during context initialization. Additionally, if the connection string is malformed, an exception is thrown before redaction occurs, leaking the raw unredacted string in exception logs. Attack vectors include: (1) reading application logs directly if the attacker has file/log aggregation access, (2) intercepting logs in downstream pipelines. No user interaction or attacker-supplied input is required—the application's own connection string configuration triggers the leak automatically. Patches are available in versions 10.0.4, 9.1.4, and 8.4.4.

## Affected products

- MongoDB Entity Framework Core Provider before 8.4.4, 9.x before 9.1.4, 10.x before 10.0.4

## Timeline

- 2026-09-17: disclosed: CVE-2026-92758 published
- 2026-09-17: patched: Fixed in versions 8.4.4, 9.1.4, 10.0.4

## References

- [https://jira.mongodb.org/browse/EF-384](https://jira.mongodb.org/browse/EF-384)

## Related threats

- [MongoDB Entity Framework Core provider expression injection in bulk update](https://junglewise.ai/threats/cve-2026-120567-the-mongodb-entity-framework-core-provider-does-not-neutralize)
- [MongoDB Entity Framework Core Provider field encryption bypass via database name misconfiguration](https://junglewise.ai/threats/cve-2026-92757-mongodb-entity-framework-core-provider-field-encryption-bypass)
- [MongoDB Entity Framework Core Provider encryption settings bypass](https://junglewise.ai/threats/cve-2026-92756-mongodb-entity-framework-core-provider-encryption-settings-bypass)