MongoDB Server version 8.3.0 has a vulnerability (CWE-532) where, during SASL authentication, the server may write full authentication parameters including credentials to its log files when connection health metric logging is enabled. This logging occurs without redacting sensitive data, potentially exposing credentials in logs accessible to users with log access. The CVSS 4.0 base score is 6.8, reflecting local attack vector with low complexity and no user interaction required, but with high confidentiality impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Sensitive authentication credentials may be exposed in server logs, which could lead to unauthorized access if log files are accessed by malicious actors. The vulnerability affects confidentiality but does not impact integrity or availability. The attack requires local access with low privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable connection health metric logging or restrict access to server logs to trusted personnel only to reduce exposure of sensitive authentication data.