CVE-2026-81530: CWE-532: Insertion of Sensitive Information into Log File in MongoDB C# Driver

The MongoDB C# Driver version 2.10.0 contains a weakness classified as CWE-532, where sensitive key-management credential material supplied by the application is included verbatim in the driver's diagnostic representation of client settings. Unlike other secret fields, these credentials are not masked, exposing them in logs or memory dumps. This exposure could allow an attacker with read access to logs or memory to obtain plaintext credentials and decrypt protected data fields.

The vulnerability allows an attacker with access to application logs, diagnostic outputs, or process memory dumps to recover plaintext key-management credentials. This could lead to unauthorized decryption of protected field data, compromising data confidentiality. The CVSS 4.0 score is 6.8 (medium severity), reflecting the local attack vector and the requirement for partial attack complexity and privileges.

No official patch or remediation is currently available for this vulnerability. Users should restrict access to application logs and diagnostic outputs to trusted personnel only and avoid exposing such data in untrusted environments. Monitor vendor advisories for updates or patches addressing this issue.