{
  "cveId": "CVE-2026-9735",
  "url": "https://patchblox.com/security/cve/CVE-2026-9735",
  "summary": "CVE-2026-9735 is fixed in MongoDB on 1 platform by MongoDB 8.3.3 (version 8.3.3), released May 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Keyfile contents are in MongoDB Server logs",
  "description": "MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.",
  "published": "2026-06-09T23:17:03Z",
  "severity": "",
  "cvss": 6.8,
  "cwe": "CWE-532: Insertion of sensitive information into log file",
  "epss": 0.00119,
  "epssPercentile": 0.0176,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2026-9735",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "MongoDB",
      "fixedVersion": "8.3.3",
      "fix": "MongoDB 8.3.3",
      "url": "https://patchblox.com/security/fix/windows-app/mongodb.server-8.3.3",
      "released": "2026-05-28T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}