CVE-2026-9735 json
Keyfile contents are in MongoDB Server logs
published 2026-06-09 5 mo ago modified 2026-09-08 2 mo ago also BIT-mongodb-2026-9735 , EUVD-2026-35856
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.
Patch / fix
- bitnami mongodb 8.3.3
- MongoDB MongoDB Server 8.3.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mongodb | >=8.3.0, <8.3.3 |
8.3.3 |
Affected products
- MongoDB MongoDB Server
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
- Technology feeds
References
-
jira.mongodb.org
/browse/SERVER-126506
vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-9735
web
Sources
- CVE List CVE-2026-9735
- NVD CVE-2026-9735
- OSV BIT-mongodb-2026-9735
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.