← All advisories

Medium severity5.5NVD Advisory· Published Jun 9, 2026· Updated Jun 12, 2026

CVE-2026-9751

CVE-2026-9751

Description

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4

Jqhph/Pymongoinferred
Package: https://pypi.org/project/pymongo
MongoDB/MongoDB2 versions
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: >=7.0.0,<7.0.35
- (no CPE)
osv-coords
pkg:bitnami/mongodb
Range: >= 7.0.0, < 7.0.35

Patches

Vulnerability mechanics

References

1

jira.mongodb.org/browse/SERVER-123370nvdVendor Advisory

News mentions

1

MongoDB: Nine Vulnerabilities Disclosed, Including Server Crashes and Data Exposure
Vypr Intelligence · Jun 9, 2026