{"cve":"CVE-2021-32050","nvd":{"published":"2023-08-29T16:15:08.423","modified":"2026-06-17T03:52:43.270","status":"Modified","description":"Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.\n\nWithout due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).\n\nThis issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-532","CWE-200"],"references":["https://jira.mongodb.org/browse/CDRIVER-3797","https://jira.mongodb.org/browse/CXX-2028","https://jira.mongodb.org/browse/NODE-3356","https://jira.mongodb.org/browse/PHPC-1869","https://jira.mongodb.org/browse/SWIFT-1229"],"products":["mongodb:c\\+\\+","mongodb:c_driver","mongodb:node.js","mongodb:php_driver","mongodb:swift_driver"],"source":"nvd","synced_at":"2026-10-19T21:39:14.809778102+00:00"},"epss":{"cve":"CVE-2021-32050","score":0.00646,"percentile":0.50989,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vxvm-qww3-2fh7","url":"https://osv.dev/vulnerability/GHSA-vxvm-qww3-2fh7","summary":"MongoDB Driver may publish events containing authentication-related data","modified":"2025-11-03T21:55:31.883495Z","packages":[{"ecosystem":"Packagist","name":"mongodb/mongodb","purl":"pkg:composer/mongodb/mongodb","ranges":[">=1.0.0 <1.9.2"],"fixed":["1.9.2"]},{"ecosystem":"npm","name":"mongodb","purl":"pkg:npm/mongodb","ranges":[">=3.6.0 <3.6.10"],"fixed":["3.6.10"]},{"ecosystem":"npm","name":"mongodb","purl":"pkg:npm/mongodb","ranges":[">=4.0.0 <4.17.0"],"fixed":["4.17.0"]},{"ecosystem":"npm","name":"mongodb","purl":"pkg:npm/mongodb","ranges":[">=5.0.0 <5.8.0"],"fixed":["5.8.0"]},{"ecosystem":"SwiftURL","name":"github.com/mongodb/mongo-swift-driver","purl":"pkg:swift/github.com/mongodb/mongo-swift-driver","ranges":[">=1.0.0 <1.1.1"],"fixed":["1.1.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}