Advisoriesby IbisCleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
Impact
Starting from driver version 4.11.0, ProxySettings.toString() included the SOCKS5 proxy username and password in application logs
Patches
The username and password are no longer included in toString() starting from driver versions 5.9.2 and higher.
Workarounds
If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.
References
https://github.com/mongodb/mongo-java-driver/blob/main/driver-core/src/main/com/mongodb/connection/ProxySettings.java
https://www.cve.org/CVERecord?id=CVE-2026-18710
https://jira.mongodb.org/browse/JAVA-6266
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mongodb-driver-reactivestreams Maven | >= 4.11.0, < 5.9.2 | 5.9.2 |
| mongodb-driver-sync Maven | >= 4.11.0, < 5.9.2 | 5.9.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)