CVE-2026-19502Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
Updated under an hour ago ()
Does this affect you?
It affects MongoDB Schema Builder CLI and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
- CVSS
- 5.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-532
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mongodb
- NVD analysis
- Analyzed
- Record last updated
- Aug 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
MongoDB Schema Builder CLI mongodb:schema_builder_cli (from the name) | from 1.0.0 before 1.2.1 | CNA record |
mongodb sql_schema_builder_cli mongodb:sql_schema_builder_cli | from 1.0.1 before 1.2.1 | NVD |
References
- https://www.mongodb.com/docs/sql-interface/changelogrelease-notes, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.