KMS master key exposure via unredacted credential serialization in driver settings string

### Impact A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data. ### Patches Fixed in 3.11.1. Key-management provider configuration is now masked in the driver's diagnostic representation of its client settings, as other secret fields already were. ### Workarounds Where the key provider supports it, configure the driver to obtain credentials on demand from the hosting environment rather than supplying them directly, so they never enter the settings object. Otherwise, avoid logging or serializing client settings objects. Upgrading does not undo prior exposure. Scrub credentials already written to logs and rotate any that may have been recorded. ### References [CSHARP-6164](https://jira.mongodb.org/browse/CSHARP-6164), [Fix](https://github.com/mongodb/mongo-csharp-driver/commit/242a7d1b2361f939fdc457aa58bb796be9226990), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-81530)

CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-532

• github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-7jhm-4g3c-cf75
• github.com/mongodb/mongo-csharp-driver