Approved changes feed: RSS · Atom

cpe:2.3:a:mongodb:schema_builder_cli:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorMongodb (1aa156a6-63a9-5032-baaf-10197d408a1e)
ProductSchema Builder Cli (5784d0fb-bfb6-5cf4-b0c8-ab44ad9b7279)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-19503 vulnerable 2026-09-16 04:34:15.653536 Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
MEDIUM (4.8)
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
Published: 2026-08-12T20:17:55.369Z
Updated: 2026-08-13T12:48:17.425Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-19502 vulnerable 2026-09-16 04:34:15.566942 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
MEDIUM (5.5)
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
Published: 2026-08-12T20:14:33.274Z
Updated: 2026-08-13T12:46:38.135Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.