Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-19502 EUVD-2026-57549GHSA-wx8h-2jpv-xvwr

Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

Published Aug 12, 2026 · Updated Aug 13, 2026 · Assigned by mongodb

Description

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.

Affected products

VendorProductAffectedFixed
MongoDB Schema Builder CLI 1.0.0 – < 1.2.1 1.2.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS mongodb No fix yet —
Ubuntu Pro 18.04 LTS mongodb No fix yet —
Ubuntu Pro 16.04 LTS mongodb No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS mongodb No fix yet —

Advisories 1

References