{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-18710 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-18710 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-18710 is a high-severity vulnerability in MongoDB Driver, published on 11 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-18710 and fix it if it is affected.\n\nWhat it is: CVE-2026-18710 is a high-severity vulnerability in MongoDB Driver, published on 11 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-18710 in the wild and no public exploit code.\n\nAffected product: MongoDB Driver. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-18710/ (Markdown: https://insights.sbomify.com/CVE-2026-18710/index.md)","id":"CVE-2026-18710","markdown":"https://insights.sbomify.com/CVE-2026-18710/index.md","name":"CVE-2026-18710","record":{"aliases":["UBUNTU-CVE-2026-18710"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"MongoDB Driver","requires_auth":"low_privilege","summary":"An attacker with log access can recover cleartext credentials from MongoDB driver logs, enabling unauthorized network authentication.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mongodb","cpe":[{"product":"java_driver","vendor":"mongodb"}],"cvss":{"score":8.2,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"description":"A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization","id":"CVE-2026-18710","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure","id":"CVE-2026-18711"},"packages":[],"prev":{"headline":"Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency","id":"CVE-2026-18709"},"products":["MongoDB Driver"],"published":"2026-08-11","related":[{"cvss_score":8.2,"headline":"Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver","id":"CVE-2026-88032","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":6.4,"headline":"MongoDB Java driver client-side field level encryption not verifying KMS host name","id":"CVE-2021-20328","kev_date_added":null,"published":"2021-02-25"},{"cvss_score":6.1,"headline":"GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver","id":"CVE-2026-88033","kev_date_added":null,"published":"2026-09-10"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-12","vendors":["MongoDB"]},"summary":"An attacker with log access can recover cleartext credentials from MongoDB driver logs, enabling unauthorized network authentication.","url":"https://insights.sbomify.com/CVE-2026-18710/"}