CVE-2026-9751 Details

A vulnerability exists in MongoDB versions 3.4.19 prior to 8.2.6, where the LDAP query password, when set through the runtime setParameter command, is logged in plain text to the mongod.log file. This issue arises because, unless the --redactClientLogData option is globally enabled, any parameter passed to mongod is recorded in the logs without encryption. The isRedact() function, which is intended to mark sensitive parameters like passwords, is not applied to the newValue logging path, creating a gap in data protection. As a result, the LDAP query password can be exposed in clear text, posing a security risk.

Users can enable the --redactClientLogData option to prevent sensitive information, such as passwords, from being logged in plain text. Instructions for managing MongoDB parameters can be found in the MongoDB documentation.