Description

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-27T17:19:59.120Z",
  "pubdate": "2026-08-27T17:19:59.120Z",
  "executiveSummary": "The MongoDB Connector for BI contains a security vulnerability where the mongodrdl utility inadvertently writes a TLS private-key password to standard error (stderr) under specific configuration conditions.\nThis vulnerability is classified as an information disclosure issue. By leaking the sensitive password during the execution process, the application exposes credentials required for secure TLS communication.\nThe impact is significant as a local user with access to the captured command output, such as through system logs or process monitoring, can obtain the plaintext password.\nCombined with access to the corresponding encrypted TLS client key file, a malicious actor could decrypt the private key, facilitating unauthorized access or impersonation within the TLS environment.\nExploitation requires local access to the system where the mongodrdl utility is executed, specifically targeting environments where configuration redundancy occurs by providing the password simultaneously via a connection URI and command-line arguments.\nThe risk implication involves the potential compromise of TLS-based authentication mechanisms, undermining the confidentiality and integrity of the database connection security.",
  "technicalDetails": "The vulnerability originates in the command-line argument processing logic within the mongodrdl utility of the MongoDB Connector for BI. The issue is triggered when a user provides a TLS private-key password through both the connection URI string and the explicit command-line flag during the invocation of the binary.\nUnder these specific conditions, the application's internal input handling routine fails to suppress sensitive data output, resulting in the plaintext password being emitted to the standard error stream (stderr).\nThe attack flow begins with the execution of the mongodrdl process. If an attacker has local access to the server environment, they can monitor command execution, process piping, or system logging services that capture stderr output. Because the utility transmits the sensitive password in cleartext within this stream, the credential is inadvertently logged or cached in transient system buffers accessible to the local user.\nOnce the password is harvested, the attacker must possess or gain access to the associated encrypted TLS client key file. With both the password and the encrypted file in their possession, the attacker can use standard cryptographic tools to decrypt the TLS private key.\nThe compromised private key allows the attacker to successfully perform unauthorized TLS client authentication. This effectively bypasses the intended security controls that protect the encrypted key, enabling the attacker to masquerade as a legitimate client or decrypt intercepted traffic if the TLS configuration relies solely on these keys for identity verification.\nThe vulnerable component is identified as the mongodrdl binary within the MongoDB Connector for BI. The issue is purely a local privilege vulnerability, requiring the attacker to be present on the host OS to intercept the process output. There is no network-based exploitation vector for this specific disclosure, but the post-exploitation impact allows for the subversion of secure network communication, potentially exposing further database credentials or sensitive data if the key is used to facilitate trust in wider network architectures.\nThe root cause is an improper logging or diagnostic routine that does not account for the potential overlap of sensitive credentials supplied via dual input methods, causing the utility to echo inputs to stderr instead of suppressing them upon verifying the provided authentication parameters."
}