Skip to content
Fencer Vulns
medium 6.5

CVE-2026-18710 json

Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

published 2026-08-11 2 mo ago modified 2026-10-23 16 d ago also EUVD-2026-57016

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

Patch / fix

  • MongoDB MongoDB Driver 5.9.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18710 updated cvss 6.5

org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization

  • Red Hat build of Apache Camel 4 for Quarkus 3 mongodb-driver-core, mongodb-driver-legacy
    affected: workaround, no fix available
  • Red Hat Build of Apache Camel 3.33.3.SP1 mongodb-driver-core 5.6.4.redhat-00001, mongodb-driver-legacy 5.6.4.redhat-00001
    fixed: vendor fix RHSA-2026:63302
  • Red Hat Build of Debezium 3.6
    fixed: vendor fix RHSA-2026:83612
  • Red Hat build of Quarkus 3.27.5.SP1 mongodb-driver-core 5.5.1.redhat-00002
    fixed: vendor fix RHSA-2026:62515
  • Red Hat build of Quarkus 3.33.3.SP1 mongodb-driver-core 5.6.4.redhat-00001
    fixed: vendor fix RHSA-2026:62555
  • Red Hat Build of Apache Camel 3.33.3.SP1 jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1617 more Red Hat build of Quarkus 3.27.5.SP1 jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat build of Quarkus 3.33.3.SP1 jna 5.8.0, h2 2.4.240, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, wasm 2.15.3, +1018 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.2 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA 4.0 8.2 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • MongoDB MongoDB Driver

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.