The vulnerability allows MongoDB server logs to capture authentication parameters, including credentials, during SASL authentication when connection health metric logging is enabled. This leads to the unintentional exposure of sensitive credentials, creating a risk of unauthorized access to the MongoDB instance or other systems that can leverage the captured credentials. The weakness is a data exposure flaw, classified as CWE-532.

Affected vendors include MongoDB for its MongoDB Server product. No specific version information is provided, so all deployed installations of MongoDB Server may be vulnerable until a patch or configuration change is applied.

The CVSS score is 6.8, indicating moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. The likely attack vector requires an attacker to have access to the server logs, which typically implies local or privilege‑assisted access. If an attacker can read the logs, they can obtain authentication credentials. The risk is considered moderate, but remediation is advised to prevent potential credential compromise.