MongoDB DEBUG Logging Sensitive Data Leak
CVE-2026-92758 Published on September 17, 2026
Logs may collect sensitive information
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.
Vulnerability Analysis
CVE-2026-92758 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Products Associated with CVE-2026-92758
Want to know whenever a new CVE is published for MongoDB? stack.watch will email you.
Affected Versions
MongoDB Inc. MongoDB Entity Framework Core Provider:- Version 8.0.0 and below 8.4.4 is affected.
- Version 9.0.0 and below 9.1.4 is affected.
- Version 10.0.0 and below 10.0.4 is affected.