CVE-2021-20331 MongoDB C# Driver Risk of Exposing Authentication Data via Command Listener
The MongoDB C# Driver may leak sensitive authentication data to application logs if the command listener feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-20331?
CVE-2021-20331 is a medium-severity vulnerability in MongoDB C# Driver, published on 13 May 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.
Weakness: CWE-200
Which versions are affected by CVE-2021-20331?
2 open source packages ship an affected version, including mongodb.driver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mongodb.driver NuGet | From 2.11.0 | 2.12.2 |
mongodb.driver NuGet | From 2.11.0 | 2.12.2 |
Products include Mongodb C\# Driver.
How do I fix CVE-2021-20331?
Upgrade mongodb.driver to 2.12.2 or later.
Is CVE-2021-20331 being exploited?
There is no known exploitation of CVE-2021-20331 in the wild and no public exploit code.
Other vulnerabilities in MongoDB C# Driver
- CVE-2026-88026 Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver
- CVE-2026-81529 Connection-option injection via unescaped settings in the canonical MongoDB URL builder
- CVE-2026-81527 NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
- CVE-2026-81530 KMS master key exposure via unredacted credential serialization in driver settings string
- CVE-2022-48282 Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution
Sources
Also known as GHSA-p9rv-qgqw-jx2w.