Executive brief
MongoDB is a widely used database system. A security flaw allows the password used for LDAP directory integration to be recorded in plain text within the system's log files when it is updated at runtime. An individual with local access to the server's logs could discover this password, potentially leading to unauthorized access to the organization's directory services.
Technical details
A sensitive information disclosure vulnerability (CWE-532) exists in MongoDB Server where the 'ldapQueryPassword' parameter is logged in plain text to 'mongod.log' when modified via the 'setParameter' command at runtime. This occurs because the 'isRedact()' check is bypassed during the logging of new parameter values, unless the global '--redactClientLogData' setting is enabled. A local attacker with read access to the server logs can retrieve the LDAP query credentials. The issue is fixed in versions 7.0.35, 8.0.24, 8.2.10, 8.3.3, and 9.0.0-rc0.
Affected products
- MongoDB MongoDB Server 3.4.19 through 8.2.6; fixed in 7.0.35, 8.0.24, 8.2.10, 8.3.3, 9.0.0-rc0
Timeline
- 2026-04-02: other: Issue reported/created in MongoDB Jira
- 2026-06-09: patched: Fix resolved in Jira and versions released
- 2026-06-09: disclosed: CVE published to NVD