CVE-2023-0436

    Dashboard / Vulnerabilities / CVE-2023-0436

    CVE-2023-0436

    Published: 7 Nov 2023Last Modified: 28 Oct 2026

    Summary: Secret logging may occur in debug mode of Atlas Operator

    Details: The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration:  DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )

    References: https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0436.json, https://nvd.nist.gov/vuln/detail/CVE-2023-0436

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 526b893b623deb6203795185f74e5dd0cafaa553
    Fixed -763db177d2d63f329c8c2a03b9744c53e93ec764

    Affected versions

    1.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-0436 | CVE-DB