This vulnerability (CWE-532) in MongoDB Server involves insertion of sensitive information into log files when schema validation is enabled and an insert or update operation violates the collection's schema. The server logs generated in these failure cases may contain unredacted user data, potentially exposing sensitive information. Affected versions include MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The CVSS 4.0 base score is 4.8, indicating medium severity. There is no vendor advisory or patch link provided, and remediation level is not specified.

Sensitive user data may be exposed in server log files when schema validation fails on insert or update operations. This could lead to unintended disclosure of confidential information stored in logs. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to server logs to trusted personnel only and monitor for any sensitive data exposure in logs related to schema validation failures.