CVE-2026-9735: MongoDB Credential Disclosure in SASL Authentication Logging

Technical summary

CVE-2026-9735 is a credential disclosure vulnerability in MongoDB arising from insufficient log sanitization during SASL authentication flows. When the connection health metric logging feature is enabled, the authentication parameter logging mechanism fails to apply redaction to sensitive fields. The vulnerability is categorized under CWE-532 (Insertion of Sensitive Information into Log File). CVSS v3.1 scoring reflects local attack vector (AV:L), low complexity (AC:L), low privilege requirements (PR:L), and high confidentiality impact (C:H) with no integrity or availability consequences.

Business impact

Compromised credentials enable unauthorized database access without requiring exploitation of network-facing vulnerabilities. An insider threat or compromised local account could harvest plaintext credentials from logs, leading to lateral movement within the database tier, data exfiltration, and compliance violations. Organizations subject to HIPAA, PCI-DSS, or SOC 2 frameworks face audit findings when credentials appear in unencrypted logs. The blast radius depends on the privileges of exposed accounts and whether they are service accounts with broad permissions.

Affected systems

MongoDB server installations with connection health metric logging enabled are affected. The vulnerability applies across MongoDB versions that implement this logging feature; verify the specific version range against the official MongoDB security advisory and your deployment's logging configuration. Non-production instances and test environments may also retain logs containing credentials if this setting is globally enabled.

Exploitability

Exploitation requires local file system access to the MongoDB server logs—either through a compromised local account, SSH access, or physical proximity. The attack does not require network traversal or advanced technical capability; reading plaintext logs is trivial once local access is obtained. However, the requirement for local access (AV:L) constrains the threat to insider threats and downstream compromises of the host itself, rather than direct remote exploitation.

Remediation

Disable connection health metric logging if it is not operationally necessary. If health metrics are required, upgrade MongoDB to a patched version that redacts authentication parameters before writing to logs. Review existing log files for the presence of credentials and ensure they are rotated, encrypted, or securely deleted. Implement least-privilege access controls on log file directories and consider centralized log aggregation with parsing rules to mask credential-like patterns.

Patch guidance

Consult the MongoDB security advisory for the specific patched version addressing this issue. Patches will include updated logging serialization logic that redacts sensitive authentication fields. Test patches in non-production environments first, as changes to logging behavior may affect diagnostic workflows. Verify that log scrubbing applies to all authentication methods supported by your deployment, not just SASL.

Detection guidance

Search MongoDB server logs (typically in /var/log/mongodb/ or configured log paths) for patterns indicating unredacted SASL authentication parameters, such as plaintext credentials immediately following authentication attempt entries. Enable centralized log collection and use SIEM rules to flag logs containing suspected passwords or usernames in authentication contexts. Monitor the MongoDB process for changes to logging configuration and audit any modifications to connection health metric settings.

Why prioritize this

Although CVSS is MEDIUM (5.5), the direct exfiltration of valid credentials elevates practical risk. Organizations with strong host-level access controls and no local unprivileged users may treat this as lower priority; those with shared systems, SSH access, or documented insider threats should prioritize patching. The vulnerability is not in the CISA KEV catalog, so no active exploitation in the wild has been officially tracked as of the advisory date.

Risk score, explained

The score reflects a high confidentiality impact (credentials disclosed) balanced against the local-only attack vector. Integrity and availability are not affected, as the vulnerability is passive disclosure rather than injection or denial of service. Organizations with strong perimeter security and disciplined access controls may view this as lower risk, while those with cloud instances or multi-tenant infrastructure should weight it more heavily due to easier local compromise.

Frequently asked questions