CVE-2026-8200 describes a vulnerability in MongoDB Server where, when schema validation is enabled on a collection and an update or insert operation violates the schema, the local server log message may not redact all user data. This could potentially lead to the exposure of sensitive information in the server logs. This vulnerability affects MongoDB Server versions 7.0.0 through 8.3.2 and has been resolved in version 8.3.2.
影响与攻击场景
The impact of CVE-2026-8200 is primarily related to data confidentiality. While the vulnerability is classified as low severity, the potential for sensitive user data to be logged and potentially exposed is a concern. An attacker who gains access to the MongoDB server logs could potentially extract this information. The blast radius is limited to the data that is inadvertently logged. This vulnerability highlights the importance of proper logging configuration and access controls to prevent unauthorized access to sensitive information. The risk is amplified if the server logs are stored in an insecure location or are accessible to unauthorized personnel.
利用背景
CVE-2026-8200 was published on 2026-05-13. The exploitability is considered low, as it requires schema validation to be enabled and a violation of the schema. Currently, no public Proof-of-Concept (POC) exploits are publicly available. The EPSS score is likely to be low, reflecting the limited impact and the requirement for specific configuration. Refer to the MongoDB security advisory for further details.
威胁情报
漏洞利用状态
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 高 — 需要管理员或特权账户。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 低 — 可访问部分数据。
- Integrity
- 无 — 无完整性影响。
- Availability
- 无 — 无可用性影响。
受影响的软件
弱点分类 (CWE)
时间线
- 发布日期
缓解措施和替代方案
The primary mitigation for CVE-2026-8200 is upgrading to MongoDB Server version 8.3.2 or later. As a temporary workaround, review and restrict access to MongoDB server logs. Ensure that logs are stored in a secure location with appropriate access controls. Consider implementing a centralized logging solution with data masking or redaction capabilities. Regularly audit log configurations to ensure that sensitive data is not being inadvertently logged. After upgrading, verify that schema validation is functioning correctly and that user data is properly redacted from server logs.
修复方法翻译中…
Actualice su instancia de MongoDB Server a la versión 7.0.34, 8.0.23, 8.2.9 o 8.3.2 o superior para mitigar este problema. La actualización corrige la falla al no redactar adecuadamente los datos del usuario en los mensajes de registro de validación de esquema, previniendo la exposición de información sensible.
常见问题
什么是CVE-2026-8200？
CVE-2026-8200是MongoDB Server中的一个漏洞，当启用模式验证且更新或插入违反模式时，服务器日志可能未删除所有用户数据。
我是否会受到影响？
如果您的MongoDB Server版本在7.0.0到8.3.2之间，并且启用了模式验证，则可能受到影响。请立即升级到8.3.2或更高版本。
如何修复？
升级到MongoDB Server 8.3.2或更高版本是修复此漏洞的主要方法。
此漏洞是否正在被利用？
目前没有公开的POC，但建议密切监控。
在哪里可以了解更多信息？
请参阅MongoDB的安全公告和NVD数据库以获取更多详细信息。
立即试用 — 无需账户
上传任何清单文件 (composer.lock, package-lock.json, WordPress 插件列表…) 或粘贴您的组件列表。您立即获得一份漏洞报告。上传文件只是开始：拥有账户后，您将获得持续监控、Slack/电子邮件警报、多项目和白标报告。
拖放您的依赖文件
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...