A MongoDB driver logs sensitive configuration information, including an outbound network credential, in cleartext during client initialization. This occurs automatically as normal operation and does not require special privileges. The cleartext credential can be recovered by anyone who can read the application logs or downstream log aggregation, allowing the attacker to authenticate to the associated network infrastructure. The weakness is a log data exposure (CWE-532).

Any application that uses the MongoDB driver from MongoDB is potentially affected. No specific driver versions are listed in the advisory, so all versions that retain this logging behavior are considered at risk until an official patch is applied.

The vulnerability carries a CVSS score of 8.2, indicating a high severity level. The EPSS score is less than 1%, showing a low but non-zero likelihood of exploitation. Because the issue depends on an attacker’s ability to read logs, the recommended attack vector is local access to log files or compromised downstream log aggregation services. The vulnerability is not listed in CISA's KEV catalog, suggesting it is not a widely known or actively exploited flaw at present.