CVE-2026-126838
Awaiting Analysis
Awaiting Analysis - Queue
MongoDB Rust Driver Key Material Exposure in Diagnostic Output
Vulnerability report for CVE-2026-126838, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-12
Last updated on: 2026-11-12
Assigner: MongoDB, Inc.
Description
Description
A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| MongoDB | Rust Driver | From 3.9.0 (inc) to 3.9.1 (exc) |
| MongoDB | Rust Driver | From 3.8.0 (inc) to 3.8.2 (exc) |
| MongoDB | Rust Driver | 3.7.0 |
| MongoDB | Rust Driver | 3.6.0 |
| MongoDB | Rust Driver | From 3.5.0 (inc) to 3.5.2 (exc) |
| MongoDB | Rust Driver | From 3.4.0 (inc) to 3.4.1 (exc) |
| MongoDB | Rust Driver | 3.3.0 |
| MongoDB | Rust Driver | From 3.2.0 (inc) to 3.2.5 (exc) |
| MongoDB | Rust Driver | From 3.1.0 (inc) to 3.1.1 (exc) |
| MongoDB | Rust Driver | From 3.0.0 (inc) to 3.0.1 (exc) |
| MongoDB | Rust Driver | From 2.8.0 (inc) to 2.8.2 (exc) |
| MongoDB | Rust Driver | From 2.7.0 (inc) to 2.7.1 (exc) |
| MongoDB | Rust Driver | From 2.6.0 (inc) to 2.6.1 (exc) |
| MongoDB | Rust Driver | 2.5.0 |
| MongoDB | Rust Driver | 2.4.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
