MongoDB LDAP Query Password Leak in Logs via setParameter Fix

Vulnerability Overview MongoDB LDAP query passwords are logged in plaintext when configured via , even if the parameter is not enabled globally. Scope of Impact Affected Versions: v3.3, v3.2, v3.0, v7.0 Fixed Versions: 9.0.0-m30, ... (4) Component: Security Tags: None Remediation Status: Fixed Fixed Versions: 9.0.0-m30, ... (4) Detailed Description Unless is globally enabled (via ), any parameters passed to will be logged in plaintext within . The only sensitive log data affected is LDAP query passwords. is the intended generic solution to prevent sensitive values from appearing in logs. The function is used to mark parameters such as passwords as sensitive, but it was never considered for new logging paths, even though it logically should have been. When LDAP query passwords are set at runtime via , they appear in the logs in plaintext unless is enabled in every version from 3.4.19 to 8.0. Activity Created: Apr 02 2026 07:47:31 PM UTC Updated: Jun 10 2026 05:57:07 PM UTC Resolved: Jun 09 2026 04:27:35 PM UTC Personnel Assignee: Ken Martin Reporter: Ken Martin Participants: GitHub User, ... (1) Votes: 0 Watchers: Started watching this issue Additional Information Type: Task Priority: Major - P3 Affects Version/s: None Component: Security Labels: None Assignee Team: Server Security Backwards Compatibility: Fully Compatible Branches to Backport: v3.3, v3.2, v3.0, v7.0 Sprints: Server Security 2026-04-10, Server Security 2026-04-24, Server Security 2026-05-08, Server Security 2026-05-22, Server Security 2026-06-05, Server Security 2026-06-19 CAR Domain: None Code Blocks No POC code or exploit code available.

Goal Reached Thanks to every supporter — we hit 100%!

MongoDB LDAP Query Password Leak in Logs via setParameter Fix