CVE-2026-19502: Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure that local users with read access to the terminal session or the MongoDB SQL Schema Builder CLI log directory cannot access the diagnostic output and log files (e.g., restrict OS permissions and access to the log directory / locations where logs are collected).
- Operational
After changing any operator-supplied authentication material that may have appeared in plaintext in MongoDB SQL Schema Builder CLI diagnostic output/log files, rotate those credentials to remove any exposed secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19502?
The severity of CVE-2026-19502 is rated as medium with a score of 5.5.
What is CVE-2026-19502 about?
CVE-2026-19502 involves insufficient redaction of sensitive configuration values in the MongoDB SQL Schema Builder CLI's diagnostic output.
How do I fix CVE-2026-19502?
You can mitigate CVE-2026-19502 by ensuring that sensitive connection settings are not logged or are properly redacted in diagnostic outputs.
What impact does CVE-2026-19502 have on MongoDB users?
CVE-2026-19502 could expose authentication material in plaintext, potentially compromising user credentials.
Is there a workaround for CVE-2026-19502?
A workaround for CVE-2026-19502 is to disable file logging or adjust logging settings to prevent sensitive data from being recorded.