This vulnerability (CWE-532) involves the insertion of sensitive information into log files by MongoDB Server when unredacted queries are logged during specific error conditions. Affected versions include MongoDB Server 6.0 before 6.0.21, 7.0 before 7.0.18, and 8.0 before 8.0.5. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No known exploits are reported in the wild. The vulnerability could expose sensitive query data in logs, potentially leading to information disclosure.

The primary impact is the exposure of sensitive information in server logs, which could be accessed by unauthorized users with access to these logs. This compromises confidentiality but does not affect integrity or availability of the MongoDB Server. The vulnerability requires high privileges to exploit and has a high attack complexity, reducing the likelihood of exploitation.

A fix is available in MongoDB Server versions 6.0.21, 7.0.18, and 8.0.5. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the version information specifying fixed versions.