CVE-2026-82070: mongodb Insufficiently Protected Credentials

Vulnerability summary

CVE-2026-82070 is a high (CVSS 7.1) Insufficiently Protected Credentials vulnerability in mongodb. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.

Timeline

1. 08-09-2026
   PublishedVulnerability first disclosed.
2. 08-09-2026
   Last modifiedVulnerability information updated.

Description

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.