CVE-2026-19502
Medium
Description
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
SeverityMedium
CVSS5.5
Exploit probability8. percentile0.2%
Product
Mongodb Sql Schema Builder Cli
PublishedAug 12, 2026
First seenAug 12, 2026
Weakness typeCWE-532CWE-532
How to fix
Update
- mongodb sql_schema_builder_cli1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb sql_schema_builder_cli | 1.0.1 ≤ v < 1.2.1 | 1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.