The MongoDB Driver version 4.11.0 contains a vulnerability classified as CWE-532, where sensitive information such as credentials used for outbound network connections is automatically written in cleartext to application logs during routine client initialization. This logging occurs without requiring special privileges, making it possible for any party with access to the logs or downstream log storage to extract these credentials and potentially authenticate to the associated network infrastructure. The vulnerability affects confidentiality but does not impact integrity or availability.

An attacker who can read the affected application's logs or any downstream log aggregation storage can recover sensitive credentials used by the MongoDB Driver for outbound network connectivity. This could lead to unauthorized authentication to network infrastructure associated with the credential. The vulnerability does not affect system integrity or availability, only confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented at this time. Until a patch is available, restrict access to application logs and log aggregation systems to trusted personnel only to reduce the risk of credential exposure.