CVE-2026-82069

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82069
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82069.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82069
Aliases
Downstream
Published
2026-09-08T16:12:28Z
Modified
2026-09-18T03:48:30Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
Details

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

Database specific 
{
    "cna_assigner":  "mongodb",
    "cwe_ids":  [
        "CWE-212"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82069.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "8.3.0"
                },
                {
                    "fixed":  "8.3.9"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo
Events
Introduced
0f29b043a58fdd251ce0a0b32754b8459613c933
Fixed
1dc3d60c3237b53589325474c668e849ecec3bae
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "8.3.0"
        },
        {
            "fixed":  "8.3.9"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

r8.*
r8.3.0
r8.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82069.json"