Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92758

Logs may collect sensitive information

CVSS 4.0 5.7 MEDIUMCVSS 3.1 5.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92758

Published

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92758

Published

MongoDB Entity Framework Core Provider

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "MongoDB Inc.",
                    "product": "MongoDB Entity Framework Core Provider",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "8.0.0",
                            "lessThan": "8.4.4",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "9.0.0",
                            "lessThan": "9.1.4",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "10.0.0",
                            "lessThan": "10.0.4",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON