Vulnerability · Published Aug 11, 2026 · Assigned by mongodb
CVE-2026-18710Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
Medium 6.5
In plain English
A medium-severity sensitive data in logs in MongoDB Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mongo-java-driver | no fix listed | UBUNTU-CVE-2026-18710 |
| Ubuntu:24.04:LTS | mongo-java-driver | no fix listed | UBUNTU-CVE-2026-18710 |
| Ubuntu:26.04:LTS | mongo-java-driver | no fix listed | UBUNTU-CVE-2026-18710 |
| Ubuntu:26.10 | mongo-java-driver | no fix listed | UBUNTU-CVE-2026-18710 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Driver | 4.11.0 – before 5.9.2 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N