CVE-2026-9751: Sensitive data could be written to mongod.log
Published Jun 9, 2026
·Updated
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
Affected Software
1 affected component
MongoDB MongoDB Server
Event History
Jun 9, 2026
CVE Published
via MITRE·10:24 PM
Data Sourced
via MITRE·10:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-9751?
CVE-2026-9751 has a medium severity score of 5.5.
2
What is the risk associated with CVE-2026-9751?
CVE-2026-9751 has a risk rating of 32.
3
How does CVE-2026-9751 affect MongoDB?
CVE-2026-9751 could lead to sensitive data being logged in plain text in the mongod.log file.
4
How do I fix CVE-2026-9751?
To mitigate CVE-2026-9751, ensure that the ldapQueryPassword parameter is not set through the runtime setParameter command.
5
What type of data is affected by CVE-2026-9751?
CVE-2026-9751 exposes sensitive information, specifically passwords, in the mongod.log file.