Schema Builder Cli
Approved changes feed: RSS · Atom
cpe:2.3:a:mongodb:schema_builder_cli:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Mongodb (1aa156a6-63a9-5032-baaf-10197d408a1e) |
|---|---|
| Product | Schema Builder Cli (5784d0fb-bfb6-5cf4-b0c8-ab44ad9b7279) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-19503 |
vulnerable | 2026-09-16 04:34:15.653536 |
Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
MEDIUM (4.8)
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
Published: 2026-08-12T20:17:55.369Z
Updated: 2026-08-13T12:48:17.425Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-19502 |
vulnerable | 2026-09-16 04:34:15.566942 |
Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
MEDIUM (5.5)
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
Published: 2026-08-12T20:14:33.274Z
Updated: 2026-08-13T12:46:38.135Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.