Read the docs
TI-2021-12015 Aliases CVE-2021-32050GHSA-vxvm-qww3-2fh7

Information disclosure in MongoDB C Driver

Priority LOW 34CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00646 51st percentileScored 2026-11-07
Fix Fixed MongoDB C Driver (MongoDB Inc): 1.17.7MongoDB C++ Driver (MongoDB Inc): 3.7.0+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoDB C Driver1.0.0 to before 1.17.71.17.7Patch availableCNA
MongoDBMongoDB C++ Driver3.0.0 to before 3.7.03.7.0Patch availableCNA
MongoDBMongoDB PHP Driver1.0.0 to before 1.9.21.9.2Patch availableCNA
MongoDBMongoDB Swift Driver1.0.0 to before 1.1.11.1.1Patch availableCNA
MongoDBMongoDB Node.js Driver3.6 to before 3.6.10; 4.0 to before 4.17.0; 5.0 to before 5.8.03.6.10, 4.17.0, 5.8.0Patch availableCNA
—mongodb/mongodb (Packagist)1.0.0 to before 1.9.21.9.2Patch availableGHSA-vxvm-qww3-2fh7
—mongodb (npm)3.6.0 to before 3.6.103.6.10Patch availableGHSA-vxvm-qww3-2fh7
—mongodb (npm)4.0.0 to before 4.17.04.17.0Patch availableGHSA-vxvm-qww3-2fh7
—mongodb (npm)5.0.0 to before 5.8.05.8.0Patch availableGHSA-vxvm-qww3-2fh7
—github.com/mongodb/mongo-swift-driver (SwiftURL)1.0.0 to before 1.1.11.1.1Patch availableGHSA-vxvm-qww3-2fh7
  • MongoDB C Driver VendorMongoDB Affected 1.0.0 to before 1.17.7 Fixed in 1.17.7 Patch available CNA
  • MongoDB C++ Driver VendorMongoDB Affected 3.0.0 to before 3.7.0 Fixed in 3.7.0 Patch available CNA
  • MongoDB PHP Driver VendorMongoDB Affected 1.0.0 to before 1.9.2 Fixed in 1.9.2 Patch available CNA
  • MongoDB Swift Driver VendorMongoDB Affected 1.0.0 to before 1.1.1 Fixed in 1.1.1 Patch available CNA
  • MongoDB Node.js Driver VendorMongoDB Affected 3.6 to before 3.6.10; 4.0 to before 4.17.0; 5.0 to before 5.8.0 Fixed in 3.6.10, 4.17.0, 5.8.0 Patch available CNA
  • mongodb/mongodb (Packagist) Vendor— Affected 1.0.0 to before 1.9.2 Fixed in 1.9.2 Patch available GHSA-vxvm-qww3-2fh7
  • mongodb (npm) Vendor— Affected 3.6.0 to before 3.6.10 Fixed in 3.6.10 Patch available GHSA-vxvm-qww3-2fh7
  • mongodb (npm) Vendor— Affected 4.0.0 to before 4.17.0 Fixed in 4.17.0 Patch available GHSA-vxvm-qww3-2fh7
  • mongodb (npm) Vendor— Affected 5.0.0 to before 5.8.0 Fixed in 5.8.0 Patch available GHSA-vxvm-qww3-2fh7
  • github.com/mongodb/mongo-swift-driver (SwiftURL) Vendor— Affected 1.0.0 to before 1.1.1 Fixed in 1.1.1 Patch available GHSA-vxvm-qww3-2fh7

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:c\+\+:*:*:*:*:*:mongodb:*:*1.0.0 to before 1.17.7VulnerableMongoDB
cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*1.0.0 to before 1.17.7VulnerableMongoDB
cpe:2.3:a:mongodb:node.js:*:*:*:*:*:mongodb:*:*3.6 to before 3.6.10; 4.0 to before 4.17.0; 5.0 to before 5.8.0VulnerableMongoDB
cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:*1.0.0 to before 1.9.2VulnerableMongoDB
cpe:2.3:a:mongodb:swift_driver:*:*:*:*:*:mongodb:*:*1.0.0 to before 1.1.1VulnerableMongoDB
  • cpe:2.3:a:mongodb:c\+\+:*:*:*:*:*:mongodb:*:* Versions 1.0.0 to before 1.17.7 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:* Versions 1.0.0 to before 1.17.7 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:node.js:*:*:*:*:*:mongodb:*:* Versions 3.6 to before 3.6.10; 4.0 to before 4.17.0; 5.0 to before 5.8.0 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:php_driver:*:*:*:*:*:mongodb:*:* Versions 1.0.0 to before 1.9.2 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:swift_driver:*:*:*:*:*:mongodb:*:* Versions 1.0.0 to before 1.1.1 Vulnerable ·MongoDB

Remediation

  • Fix · CNA MongoDB C Driver (MongoDB Inc) Fixed in 1.17.7
  • Fix · CNA MongoDB C++ Driver (MongoDB Inc) Fixed in 3.7.0
  • Fix · CNA MongoDB PHP Driver (MongoDB Inc) Fixed in 1.9.2
  • Fix · CNA MongoDB Swift Driver (MongoDB Inc) Fixed in 1.1.1
  • Fix · CNA MongoDB Node.js Driver (MongoDB Inc) Fixed in 3.6.10, 4.17.0, 5.8.0
  • Fix · GHSA-vxvm-qww3-2fh7 mongodb/mongodb (Packagist) Fixed in 1.9.2 Advisory →
  • Fix · GHSA-vxvm-qww3-2fh7 mongodb (npm) Fixed in 3.6.10 Advisory →
  • Fix · GHSA-vxvm-qww3-2fh7 mongodb (npm) Fixed in 4.17.0 Advisory →
  • Fix · GHSA-vxvm-qww3-2fh7 mongodb (npm) Fixed in 5.8.0 Advisory →
  • Fix · GHSA-vxvm-qww3-2fh7 github.com/mongodb/mongo-swift-driver (SwiftURL) Fixed in 1.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32050
  2. 2026-10-03 Alias added: GHSA-vxvm-qww3-2fh7
  3. 2026-10-19 EPSS moved to the 50th–90th percentile

References

Patch 4

Advisory 1

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences