MongoDBGHSA-h5c2-f56c-mcqh
Insertion of Sensitive Information into Log File
Medium5.7CVE-2026-92758 · Published Sep 17, 2026
### Impact If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys. ### Patches Fixed in 8.4.4, 9.1.4, 10.0.4, ### Workarounds No known workarounds. ### References [EF-384](https://jira.mongodb.org/browse/EF-384), [EF-386](https://jira.mongodb.org/browse/EF-386), [Fix](https://github.com/mongodb/mongo-efcore-provider/commit/ef6f222a4885c98c40b32954209a6d9c372d5d47), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-92758)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB.EntityFrameworkCore NuGet | >= 8.0.0, < 8.4.4 | 8.4.4 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 18 | MongoDB Mongoid: unsafe reflection | High8.3 | No fix yet |
| Sep 18 | Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream | High8.1 | 1.30.11+1 more |
| Sep 17 | Silent plaintext storage of encrypted fields via mis-keyed encryption map in the EF Core provider | Medium6.8 | 8.4.4 |
| Sep 17 | A flaw in libmongoc's SCRAM authentication implementation caused the client to... | Medium6.3 | 2.3.2 |
| Sep 17 | MongoDB C Driver: integer overflow | Medium6.9 | 2.3.1 |
| Sep 17 | MongoDB Entity Framework Core Provider: missing encryption | Medium6.8 | 8.4.3+2 more |