The vulnerability occurs in the MongoDB Connector for BI when the TLS private‑key password is supplied both through the connection URI and as a command‑line option. In this scenario, mongodrdl writes the password to standard error. This constitutes a CWE‑532 weakness, where sensitive information is written to log output. A local user who can capture the command output and who also has access to the encrypted key file can discover the password and use it to decrypt the TLS client key.

Affected systems include any installation of the MongoDB Connector for BI that accepts duplicate password specifications. The issue is documented in the release notes for version 2.14.30 and may be present in earlier releases. No specific version constraints are listed beyond the vendor’s current release.

With a CVSS score of 4.1, the exploitability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires local access to command‑output logs and the encrypted key file; a local attacker who can read these artefacts could recover the TLS password, potentially compromising encrypted communications. Existing mitigations involve restricting log output and ensuring passwords are provided through only one channel.