CVE-2026-9751
No fix known EPSS <1%CVSS 5.5
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
Products: mongodb_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu:Pro:14.04:LTS | mongodb | no fix |
| Ubuntu:Pro:16.04:LTS | mongodb | no fix |
| Ubuntu:Pro:18.04:LTS | mongodb | no fix |
| Ubuntu:Pro:20.04:LTS | mongodb | no fix |