CVE-2023-0436

The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration:  DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )

• CWE-532
• CWE-532

• https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1Release Notes, Vendor Advisory
• https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1Release Notes, Vendor Advisory

Published

Nov 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0430Certificate OCSP revocation status was not checked when veri…6.5
• CVE-2023-0431The File Away WordPress plugin through 3.9.9.0.1 does not va…5.4
• CVE-2023-0432 The web configuration service of the affected device contai…9
• CVE-2023-0433Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8
• CVE-2023-0434Improper Input Validation in GitHub repository pyload/pyload…7.5
• CVE-2023-0435Excessive Attack Surface in GitHub repository pyload/pyload …9.8
• CVE-2023-0437When calling bson_utf8_validate on some inputs a loop with a…7.5
• CVE-2023-0438Cross-Site Request Forgery (CSRF) in GitHub repository modob…6.5
• CVE-2023-0439The NEX-Forms WordPress plugin before 8.4.4 does not escape …5.4
• CVE-2023-0440Observable Discrepancy in GitHub repository healthchecks/hea…5.3
• CVE-2023-0441The Gallery Blocks with Lightbox WordPress plugin before 3.0…8.1
• CVE-2023-0442The Loan Comparison WordPress plugin before 1.5.3 does not v…6.1