Vulnerability · Published Aug 12, 2026 · Assigned by mongodb
CVE-2026-19502Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
Medium 5.5
In plain English
A medium-severity sensitive data in logs in Schema Builder CLI from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Schema Builder CLI | 1.0.0 – before 1.2.1 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N