Answer in brief
CVE-2026-18710 records a Unknown severity vulnerability in Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization. The current sources do not mark it as known exploited. The current feed maps MongoDB/MongoDB Driver (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps MongoDB/MongoDB Driver (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| MongoDB/MongoDB Drivergeneric | >=4.11.0 <5.9.2 | 5.9.2 |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-18710 records a Unknown severity vulnerability in Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization. The current sources do not mark it as known exploited. The current feed maps MongoDB/MongoDB Driver (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps MongoDB/MongoDB Driver (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| MongoDB/MongoDB Drivergeneric | >=4.11.0 <5.9.2 | 5.9.2 |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.
Quoted source text, attributed separately from HOL analysis.