Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

Medium6.5CVE-2026-18710 · Published Aug 11, 2026

### Impact Starting from driver version 4.11.0, `ProxySettings.toString()` included the SOCKS5 proxy username and password in application logs ### Patches The username and password are no longer included in `toString()` starting from driver versions 5.9.2 and higher. ### Workarounds If you cannot upgrade, set the `org.mongodb.driver.client` logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs. ### References https://github.com/mongodb/mongo-java-driver/blob/main/driver-core/src/main/com/mongodb/connection/ProxySettings.java https://www.cve.org/CVERecord?id=CVE-2026-18710 https://jira.mongodb.org/browse/JAVA-6266