Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.
BIT-mongodb-2026-82070
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:BIT-mongodb-2026-82070
mongodb
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 7.0.40
Source reference:
/affected/0/ranges8.0.29Source reference:
/affected/0/ranges8.3.8Source reference:
/affected/0/ranges9.0.2Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.40"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.29"
},
{
"introduced": "8.2.0"
},
{
"fixed": "8.3.8"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.2"
}
]
}
],
"package": {
"name": "mongodb",
"purl": "pkg:bitnami/mongodb",
"ecosystem": "Bitnami"
},
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"database_specific": {
"source": "https://github.com/bitnami/vulndb/tree/main/data/mongodb/BIT-mongodb-2026-82070.json"
}
}
]- Related CVEs
- CVE-2026-82070
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #59527 · Revision 1
- Added to Heist Feed
- Publisher date