CVE-2026-9751
Last modified
CVE-2026-9751 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | Mongodb | >= 7.0.0, < 7.0.35 |
| Mongodb | Mongodb | >= 8.0.0, < 8.0.24 |
| Mongodb | Mongodb | >= 8.2.0, < 8.2.10 |
| Mongodb | Mongodb | >= 8.3.0, < 8.3.3 |
References
- https://jira.mongodb.org/browse/SERVER-123370Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-9751?
How severe is CVE-2026-9751?
How do I fix CVE-2026-9751?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9743In MongoDB Server 8.0, an aggregation stage can leave its _s…7.1
- CVE-2026-9746When using $changestreams and $_requestReshardingResumeToken…7.1
- CVE-2026-9747Adding fromRouter:true and runtimeConstants.userRoles could …7.1
- CVE-2026-9748The $_internalConvertBucketIndexStats stage used PauseExecut…7.1
- CVE-2026-9749This issue can occur when running an aggregation pipeline th…7.1
- CVE-2026-9750An authenticated user can cause a MongoDB server to crash or…7.1
- CVE-2026-9752An authorized user could trigger a server crash by running a…7.1
- CVE-2026-9753The $_internalApplyOplogUpdate aggregation pipeline stage ca…8.1
- CVE-2026-9754An authenticated user with the read role may read limited am…7.1
- CVE-2026-9756The GenerateBlocks plugin for WordPress is vulnerable to Sto…6.4
- CVE-2026-9757The GEO my WP plugin for WordPress is vulnerable to SQL Inje…7.5
- CVE-2026-9758Improper comparison with the certificates trusted list in S2…7.3
Are you affected by CVE-2026-9751?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST