CVE-2026-82070

MongoDB Server's diagnostic reporting interface returns credentials from concurrent administrative operations without the redaction that the server applies to its log output, leaving those cleartext credentials readable by authenticated users (CWE-522, insufficiently protected credentials). To trigger it, an attacker needs a valid authenticated session with monitoring-level privileges and network access to the server, then reads diagnostic output while administrative operations are in progress. The payoff is disclosure of other users' credentials — potentially including privileged accounts — enabling impersonation and privilege escalation, with no direct integrity or availability impact (CVSS 4.0: 7.1 High, network vector, low privileges required). Any self-managed MongoDB Server deployment that grants monitoring roles to users or tooling that is not fully trusted is in scope; specific affected version ranges were not included in the available data. Exploitation has not been observed: no public PoC, not listed in CISA KEV, and EPSS is low at ~0.2% (16th percentile).

What to do: Consult MongoDB's security advisory for CVE-2026-82070 to identify the affected and fixed versions (not specified in the data provided) and upgrade affected servers promptly. Until patched, limit monitoring-privileged roles to trusted operators and dedicated monitoring tooling, and rotate credentials used in administrative operations on clusters where monitor roles are broadly assigned. With no public PoC, KEV listing, or observed exploitation, this is a routine-priority patch rather than an emergency.