Read the docs
TI-2026-15335 Aliases CVE-2026-18710

Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

Priority LOW 35CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-532.

Summary

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00145 3rd percentileScored 2026-11-07
Fix Partial MongoDB Driver (MongoDB): 5.9.2Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoDB Driver4.11.0 to before 5.9.25.9.2Patch availableCNA
  • MongoDB Driver VendorMongoDB Affected 4.11.0 to before 5.9.2 Fixed in 5.9.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*4.11.1 to before 5.9.2VulnerableMongoDB
  • cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* Versions 4.11.1 to before 5.9.2 Vulnerable ·MongoDB

Remediation

  • Fix · CNA MongoDB Driver (MongoDB) Fixed in 5.9.2

Red Hat 4 advisories

  • RHSA-2026:83612 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Debezium 3.6.3 release
    • Red Hat Build of Debezium 3.6
  • RHSA-2026:63302 Released 2026-09-03 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
    • Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
  • RHSA-2026:62555 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP1 release and security update
    • Red Hat build of Quarkus 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-oidc-3.33.3.redhat-00005.jar +6
Show 1 more Red Hat advisories
  • RHSA-2026:62515 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP1 release and security update
    • Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.3.SP1Fixed RHSA-2026:63302
Red Hat Build of Debezium 3.6Fixed RHSA-2026:83612
Red Hat build of Quarkus 3.27.5.SP1Fixed RHSA-2026:62515
Red Hat build of Quarkus 3.33.3.SP1Fixed RHSA-2026:62555
Not affected: 3 products
  • Red Hat Build of Apache Camel 3.33.3.SP1
  • Red Hat build of Quarkus 3.27.5.SP1
  • Red Hat build of Quarkus 3.33.3.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18710
  2. 2026-10-09 Fix available: RHSA-2026:62555 · Red Hat
  3. 2026-10-09 Fix available: RHSA-2026:63302 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:62515 · Red Hat
  5. 2026-10-12 Fix available: Red Hat Build of Apache Camel 3.33.3.SP1, Red Hat build of Quarkus 3.27.5.SP1, Red Hat build of Quarkus 3.33.3.SP1 · Red Hat
  6. 2026-10-16 Fix available: RHSA-2026:83612 · Red Hat
  7. 2026-10-16 Fix available: Red Hat Build of Debezium 3.6 · Red Hat
  8. 2026-10-20 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2026-60057 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver CVSS 4.0HIGH 8.2
  • TI-2021-03616 MongoDB Java driver client-side field level encryption not verifying KMS host name CVSS 3.1MEDIUM 6.8
  • TI-2026-60058 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver CVSS 4.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences