-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mongodb | rust | >= 1.0.0, <= 2.0.0-alpha1 | 2.0.0-beta |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key points: 1) The pool creation event emission in mod.rs directly exposed internal ConnectionPoolOptions containing credentials. 2) The options construction in options.rs included credentials without filtering. The patch introduced a separate EventOptions type that excludes sensitive fields and modified the event emission to use to_event_options(), confirming these were the vulnerable paths. The direct passing of options in the pre-patch PoolCreatedEvent handler and the credential inclusion in ConnectionPoolOptions construction are clear vulnerability sources.