# CVE-2026-82070: Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface

> CVE-2026-82070: Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-82070
Last updated: 2026-09-16T20:38:56Z

- Published: 2026-09-08 16:12 UTC · Updated: 2026-09-16 20:38 UTC · Assigner: mongodb
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.33%, 25th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-522

## Description

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-82070)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-82070)
- [https://jira.mongodb.org/browse/SERVER-131423](https://jira.mongodb.org/browse/SERVER-131423)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-82070 · Markdown: https://rewindex.com/cve/CVE-2026-82070.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-82070 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:46.441Z