MongoDB Schema Builder CLI vulnerabilities

Latest MongoDB Schema Builder CLI CVEs

Newest publication first

1. CVE-2026-19503 Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

   Published 2026-08-12

   Medium·CVSS 6.3 EPSS 0.20%

   MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have...

2. CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

   Published 2026-08-12

   Medium·CVSS 6.8 EPSS 0.18%

   MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.