MongoDB C# Driver Exposes Key Material in Diagnostics
CVE-2026-81530 Published on August 27, 2026
KMS master key exposure via unredacted credential serialization in driver settings string
A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.
Vulnerability Analysis
CVE-2026-81530 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Products Associated with CVE-2026-81530
Want to know whenever a new CVE is published for MongoDB C Driver? stack.watch will email you.
Affected Versions
MongoDB C# Driver:- Version 2.10.0 and below 3.11.1 is affected.