This vulnerability (CWE-532) involves the insertion of sensitive information into log files by the MongoDB Entity Framework Core Provider when operating in DEBUG logging mode or when processing malformed MongoDB connection strings. Sensitive data such as passwords and AWS secure access keys may be captured in application logs, potentially exposing them to unauthorized access. The vulnerability affects versions >=8.0.0 <8.4.4, >=9.0.0 <9.1.4, and >=10.0.0 <10.0.4. The CVSS 4.0 score is 5.7 (medium severity), reflecting local attack vector with low complexity and partial privileges required. The vendor has released patches to remediate this issue.

Sensitive credentials including passwords and AWS secure access keys may be exposed in application logs if DEBUG logging is enabled or if malformed connection strings are used. This exposure could lead to unauthorized access if logs are accessed by attackers or unauthorized personnel. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should apply the official fixes for affected versions to prevent sensitive information from being logged. Additionally, avoid using DEBUG logging mode in production environments and ensure connection strings are properly validated to reduce risk.