Read the docs
TI-2026-15877 Aliases CVE-2026-19502GHSA-wx8h-2jpv-xvwr

Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

Priority LOW 29CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix Fixed Schema Builder CLI (MongoDB): 1.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBSchema Builder CLI1.0.0 to before 1.2.11.2.1Patch availableCNA
  • Schema Builder CLI VendorMongoDB Affected 1.0.0 to before 1.2.1 Fixed in 1.2.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:sql_schema_builder_cli:*:*:*:*:*:*:*:*1.0.1 to before 1.2.1VulnerableMongoDB
  • cpe:2.3:a:mongodb:sql_schema_builder_cli:*:*:*:*:*:*:*:* Versions 1.0.1 to before 1.2.1 Vulnerable ·MongoDB

Remediation

  • Fix · CNA Schema Builder CLI (MongoDB) Fixed in 1.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB Schema Builder CLI 1.2.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-15878 Insufficient OIDC endpoint validation could invoke unintended local protocol handlersPriority LOW 27
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19502
  2. 2026-10-03 Alias added: GHSA-wx8h-2jpv-xvwr

References

Advisory 1

  • TI-2026-15878 Insufficient OIDC endpoint validation could invoke unintended local protocol handlers CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences