CVE-2026-19502
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file. Certain connection settings were written without redaction, so authentication material could appear in plaintext in diagnostic output. A local user with read access to the terminal or log directory, or anyone with access to collected logs, could obtain those values.
Risk Assessment
Risk of credential disclosure in logs, potentially enabling unauthorized access to systems.
Recommendation
Update MongoDB SQL Schema Builder CLI to a version that redacts authentication material in logs.
Original NVD description (English source)
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.