CVE-2026-82070

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.

• CWE-522

• https://jira.mongodb.org/browse/SERVER-131423

Published

Sep 8, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82065A security issue in the MongoDB Server's storage engine inte…6.5
• CVE-2026-82066A heap out-of-bounds read security issue exists in the query…4.3
• CVE-2026-82067Improper handling of case sensitivity in the configuration v…8.1
• CVE-2026-82068A security issue in MongoDB Server allows an authenticated u…6.5
• CVE-2026-82069A security issue in MongoDB Server's query statistics serial…2.7
• CVE-2026-8207Gibbon versions before v30.0.01 are affected by an authentic…7
• CVE-2026-82071Insufficient validation of storage engine configuration opti…8.1
• CVE-2026-82072Out of bounds read in V8 in Google Chrome prior to 151.0.792…8.8
• CVE-2026-82073A security issue in the MongoDB Server aggregation framework…6.5
• CVE-2026-82074MongoDB Server contains an incorrect authorization vulnerabi…6.5
• CVE-2026-82075An uncontrolled resource consumption weakness exists in the …7.5
• CVE-2026-82076An integer overflow in the query planning component of Mongo…6.5