CVE-2026-19502

Received Received - Intake

MongoDB CLI Discloses Plaintext Credentials in Logs

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: MongoDB, Inc.

Description

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-19502

EUVD

EUVD-2026-57549

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_sql_schema_builder_cli	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability involves MongoDB's SQL Schema Builder CLI exposing authentication credentials in plaintext. When the tool starts up, it writes connection settings, including passwords or other sensitive authentication material, to standard output and log files without redaction. This means anyone with access to the terminal session or log files could view these credentials.

Detection Guidance

Check MongoDB SQL Schema Builder CLI logs and terminal output for plaintext authentication material. Search for sensitive connection strings or credentials in log files or command history.

Impact Analysis

If you use MongoDB SQL Schema Builder CLI, attackers or unauthorized users with access to logs or terminal output could steal your authentication credentials. This could lead to unauthorized database access, data breaches, or further attacks on your systems using the compromised credentials.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA, which mandate protection of sensitive data, including authentication credentials. Exposure of such data may result in regulatory penalties, loss of trust, and legal consequences due to non-compliance with data protection standards.

Mitigation Strategies

Disable file logging for MongoDB SQL Schema Builder CLI if enabled. Avoid passing authentication material via command-line arguments. Review and redact any existing logs containing sensitive data.

Hi! I’m here to help you understand CVE-2026-19502. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70