Medium severity · published Aug 2, 2021
CVE-2021-20332
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is…
4.4
CVSS
0.3%
EPSS
No
On KEV
Description
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RD
Rust Driver · Mongodb
1.0.0 through 1.2.1; 2.0.0; 2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20332
Patch
https://jira.mongodb.org/browse/RUST-591
More from Rust Driver
8.3
CVE-2026-88024
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver
7.5
CVE-2025-11695
When tlsInsecure=False appears in a connection string, certificate validation is disabled
7.5
CVE-2024-6382
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands
6.5
CVE-2026-81526
Cross-database write redirection via unvalidated dotted database name in bulk write namespaces