MongoDBGHSA-h5c2-f56c-mcqh

Insertion of Sensitive Information into Log File

CVE-2026-92758 · Published Sep 17, 2026

Medium5.7

Fix: upgrade to 8.4.4 or later

Impact

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.

Patches

Fixed in 8.4.4, 9.1.4, 10.0.4,

Workarounds

No known workarounds.

References

[EF-384](https://jira.mongodb.org/browse/EF-384), [EF-386](https://jira.mongodb.org/browse/EF-386), [Fix](https://github.com/mongodb/mongo-efcore-provider/commit/ef6f222a4885c98c40b32954209a6d9c372d5d47), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-92758)

Affected versions

Package	Affected	Fixed in
MongoDB.EntityFrameworkCore NuGet	>= 8.0.0, < 8.4.4	8.4.4

Details and references

CVSS 4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Severity from: GitHub (reviewed advisory)

More MongoDB advisories

All MongoDB

High 8.3Sep 18

MongoDB Mongoid: unsafe reflectionCVE-2026-93765no fix yet High 8.1Sep 18

Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamCVE-2026-93393fixed in 1.30.11 +1 Medium 6.8Sep 17

Silent plaintext storage of encrypted fields via mis-keyed encryption map in the EF Core providerCVE-2026-92757fixed in 8.4.4 Medium 6.3Sep 17

A flaw in libmongoc's SCRAM authentication implementation caused the client to...CVE-2026-93394fixed in 2.3.2 Medium 6.9Sep 17

MongoDB C Driver: integer overflowCVE-2026-93395fixed in 2.3.1 Medium 6.8Sep 17

MongoDB Entity Framework Core Provider: missing encryptionCVE-2026-92756fixed in 8.4.3 +2