CVE-2026-19503
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of authorization and token endpoints from an OIDC issuer's discovery document. A user tricked into connecting to an uncontrolled MongoDB deployment with MONGODB-OIDC may have an uncontrolled URI dispatched to the OS default protocol handler, potentially exposing credentials or leading to code execution.
Risk Assessment
Risk of credential exposure or code execution in the user's context, potentially leading to system compromise.
Recommendation
Update MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver to versions that include the URI scheme validation fix.
Original NVD description (English source)
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.