---
id: CVE-2026-82070
title: >-
  A security issue in MongoDB Server's diagnostic reporting interface allows an
  authenticated user with monitoring privileges to access insufficiently
  protected credentials from concurrent administrative operations
summary: >-
  A security issue in MongoDB Server's diagnostic reporting interface allows an
  authenticated user with monitoring privileges to access insufficiently
  protected credentials from concurrent administrative operations. The same
  credentials ar…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-522
vendor: mongodb
product: mongodb
affected:
  - 'mongodb >= 7.0.0, < 7.0.40'
  - 'mongodb >= 8.0.0, < 8.0.29'
  - 'mongodb >= 8.2.0, <= 8.2.12'
  - 'mongodb >= 8.3.0, < 8.3.8'
  - mongodb = 9.0.0
  - mongodb = 9.1.0
patched:
  - mongodb 8.3.8
published: '2026-09-08'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:38:56.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82070'
references:
  - url: 'https://jira.mongodb.org/browse/SERVER-131423'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
epss: 0.00326
epssPercentile: 0.22934
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T17:52:28.952873Z'
ingestedAt: '2026-09-08T16:34:19.257Z'
---

## Overview

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.

## Affected

- `mongodb >= 7.0.0, < 7.0.40`
- `mongodb >= 8.0.0, < 8.0.29`
- `mongodb >= 8.2.0, <= 8.2.12`
- `mongodb >= 8.3.0, < 8.3.8`
- `mongodb = 9.0.0`
- `mongodb = 9.1.0`

## Remediation

Upgrade past the affected range:

- `mongodb 8.3.8`