The vulnerability identified as CVE-2026-9751 involves the insertion of sensitive information into log files (CWE-532) in MongoDB Server. Specifically, when the ldapQueryPassword parameter is set at runtime using the setParameter command, the new password value is recorded in plaintext within the mongod.log file. This behavior risks exposing sensitive credentials to anyone with access to the log files. The vulnerability affects MongoDB Server versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. The CVSS 4.0 vector indicates local attack vector with low complexity and low privileges required, no user interaction, and high vulnerability confidentiality impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The primary impact is the exposure of sensitive LDAP query passwords in plaintext within MongoDB server log files. This can lead to credential compromise if unauthorized users gain access to these logs. The vulnerability does not directly enable remote code execution or privilege escalation but compromises confidentiality of sensitive authentication data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should restrict access to mongod.log files to trusted administrators only and avoid setting the ldapQueryPassword parameter via the runtime setParameter command if possible. Monitoring and auditing access to log files is recommended to detect unauthorized access.