MongoDB Rust Driver KMS Credential Leak via Diagnostic Output
CVE-2026-126838 Published on November 12, 2026
Rust Driver public Client Debug output exposes CSFLE KMS master-key material
A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.
Vulnerability Analysis
CVE-2026-126838 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Affected Versions
MongoDB Rust Driver:- Version 3.9.0 and below 3.9.1 is affected.
- Version 3.8.0 and below 3.8.2 is affected.
- Version 3.7.0 is affected.
- Version 3.6.0 is affected.
- Version 3.5.0 and below 3.5.2 is affected.
- Version 3.4.0 and below 3.4.1 is affected.
- Version 3.3.0 is affected.
- Version 3.2.0 and below 3.2.5 is affected.
- Version 3.1.0 and below 3.1.1 is affected.
- Version 3.0.0 and below 3.0.1 is affected.
- Version 2.8.0 and below 2.8.2 is affected.
- Version 2.7.0 and below 2.7.1 is affected.
- Version 2.6.0 and below 2.6.1 is affected.
- Version 2.5.0 is affected.
- Version 2.4.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.