Vulnerability · Published Jul 7, 2025 · Assigned by mongodb
CVE-2025-6711Incomplete Redaction of Sensitive Information in MongoDB Server Logs
Medium 4.4
In plain English
A medium-severity sensitive data in logs in MongoDB Server from MongoDB Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.3%top 79.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc | MongoDB Server | 6.0 – before 6.0.217.0 – before 7.0.188.0 – before 8.0.5 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N