CVE-2026-19502 Overview
CVE-2026-19502 is an information disclosure vulnerability in the MongoDB SQL Schema Builder command-line interface (CLI). The tool writes its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings are written without redaction, so authentication material supplied by the operator can appear in plaintext in that diagnostic output. Any local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are later collected, could obtain those credentials. This weakness is categorized under CWE-532: Insertion of Sensitive Information into Log File.
Critical Impact
Plaintext authentication material written to console and log files can be harvested by local users or log-aggregation pipelines, enabling downstream credential reuse against MongoDB backends.
Affected Products
- MongoDB SQL Schema Builder CLI (see the MongoDB SQL Interface Changelog for fixed versions)
- Deployments where CLI file logging is enabled
- Environments that ship CLI stdout or log files to centralized log collectors
Discovery Timeline
- 2026-08-12 - CVE-2026-19502 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19502
Vulnerability Analysis
The MongoDB SQL Schema Builder CLI emits a diagnostic snapshot of its runtime configuration at startup. This snapshot describes the connection parameters supplied by the operator, including options that carry authentication material. The CLI writes the snapshot to standard output and, when file logging is enabled, also appends it to a log file on disk.
The configuration serializer does not apply redaction to sensitive connection fields. Values such as passwords or connection strings that embed credentials are written verbatim. The exposure persists for the lifetime of the terminal scrollback buffer and the log file, and it propagates to any downstream system that ingests those artifacts.
Exploitation requires local access or read access to a location where the CLI output has been collected. An attacker with those preconditions can recover MongoDB credentials and reuse them against the backing database.
Root Cause
The root cause is missing sanitization of sensitive fields in a diagnostic logging path, consistent with [CWE-532]. The CLI treats the full configuration object as safe to render for operator visibility. Password-bearing fields are not tagged as secrets and are not replaced with a masked placeholder before serialization.
Attack Vector
The attack vector is local. An adversary needs read access to the terminal session output, the CLI log directory, or any downstream log store that received the CLI output. Typical scenarios include shared jump hosts, CI/CD runners that archive job output, and centralized log platforms that ingest application stdout. No interaction with the CLI operator is required after the credentials have been logged.
The vulnerability does not enable remote exploitation on its own. However, harvested credentials can be reused remotely against the MongoDB deployment they were intended to authenticate to.
Detection Methods for CVE-2026-19502
Indicators of Compromise
- Presence of MongoDB SQL Schema Builder CLI log files containing connection strings or password fields in plaintext
- Terminal session recordings or CI/CD job logs that include the CLI startup configuration block
- Read access events on CLI log directories by accounts other than the CLI operator
- Outbound MongoDB authentication attempts from hosts that read CLI logs but do not normally connect to the database
Detection Strategies
- Scan log aggregation platforms and file shares for the CLI startup configuration pattern and credential-shaped substrings such as password=, mongodb://, and mongodb+srv:// with embedded userinfo.
- Review CI/CD pipeline artifacts and container stdout captures for the SQL Schema Builder CLI banner and treat matching runs as credential-exposure incidents.
- Correlate MongoDB authentication events with host identities that ran the CLI to identify credential reuse from unexpected sources.
Monitoring Recommendations
- Enable file integrity and access monitoring on the CLI log directory and alert on reads by non-operator accounts.
- Add secret-detection rules to log ingestion pipelines so plaintext credentials are quarantined rather than indexed and retained.
- Track MongoDB authentication failures and geolocation anomalies for any account whose credentials were passed to the CLI before patching.
How to Mitigate CVE-2026-19502
Immediate Actions Required
- Upgrade the MongoDB SQL Schema Builder CLI to the fixed version listed in the MongoDB SQL Interface Changelog.
- Rotate every MongoDB credential that was previously supplied to an affected CLI build, including service accounts used by automation.
- Purge historical CLI log files, terminal recordings, and archived CI/CD job output that may contain the plaintext configuration snapshot.
Patch Information
Refer to the MongoDB SQL Interface Changelog for the specific SQL Schema Builder CLI release that redacts sensitive fields in the startup configuration output. Apply the fixed version across all workstations, jump hosts, and automation runners that invoke the CLI.
Workarounds
- Disable file logging on the CLI until the patched version is deployed, and avoid running the CLI on shared hosts.
- Supply credentials through short-lived, scoped accounts so any exposure can be revoked quickly.
- Restrict filesystem permissions on the CLI log directory to the invoking user only, and exclude the directory from log-collection agents.
- Redirect CLI stdout to a file with restricted permissions and review it before allowing it to reach any shared log platform.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
