CVE-2026-19503: MongoDB OIDC Authentication RCE Vulnerability

CVE-2026-19503 Overview

CVE-2026-19503 affects MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver. Both components fail to validate the URL scheme of authorization and token endpoints returned by an OpenID Connect (OIDC) issuer's discovery document. An attacker operating an uncontrolled MongoDB deployment can induce a client using MONGODB-OIDC authentication to dispatch an arbitrary URI to the operating system's default protocol handler. This behavior can expose credentials or, under specific conditions, achieve code execution in the user's context. The weakness is tracked under CWE-20: Improper Input Validation.

Critical Impact
A malicious MongoDB endpoint can hijack the OIDC discovery flow to launch arbitrary protocol handlers on a victim workstation, leading to credential exposure or user-context code execution.

Affected Products

MongoDB Schema Manager
MongoDB Atlas SQL ODBC Driver
Client environments using MONGODB-OIDC authentication

Discovery Timeline

2026-08-12 - CVE-2026-19503 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19503

Vulnerability Analysis

The vulnerability resides in the OIDC client logic used by MongoDB Schema Manager and the MongoDB Atlas SQL ODBC Driver. When a client authenticates using the MONGODB-OIDC mechanism, it fetches an OIDC discovery document from the server-supplied issuer. That document declares authorization_endpoint and token_endpoint URLs the client will subsequently open.

Neither component validates the scheme of these endpoint URLs. Instead of restricting the values to https://, the client accepts arbitrary schemes such as file://, ldap://, smb://, or custom application handlers. The client then passes the URL to the operating system's default protocol handler.

On Windows and macOS, protocol handlers are frequently mapped to local applications. Dispatching an attacker-controlled URI can trigger SMB authentication attempts leaking NTLM hashes, load remote content through registered handlers, or invoke installed applications that execute code embedded in the URI.

Root Cause

The root cause is improper input validation of externally supplied URL fields inside the OIDC discovery response. The client trusts the issuer to return well-formed HTTPS endpoints and forwards the values to the OS shell without a scheme allowlist or URL sanitization step.

Attack Vector

Exploitation requires a user to be induced into connecting to a MongoDB deployment controlled by the attacker while using MONGODB-OIDC authentication. Once the client initiates the OIDC handshake, the attacker's discovery document supplies a malicious authorization_endpoint. The client dispatches the URI to the operating system, which invokes the associated protocol handler in the user's session.

Vulnerability mechanism (prose description):

1. Victim connects to attacker-controlled MongoDB URI with MONGODB-OIDC auth.
2. Client requests the OIDC discovery document from the attacker's issuer.
3. Discovery document returns authorization_endpoint using a non-HTTPS scheme.
4. Client passes the raw URI to the OS default protocol handler.
5. Handler executes attacker logic in the user's security context.

No verified proof-of-concept code is published. See the MongoDB SQL Interface
Changelog for fix details.

Detection Methods for CVE-2026-19503

Indicators of Compromise

Outbound connections from developer or analyst workstations to unexpected MongoDB endpoints over the wire protocol.
Process creation events where mongosqltranslate, ODBC driver hosts, or Schema Manager processes spawn shell handlers, browsers, or protocol-registered applications.
SMB or LDAP authentication attempts originating from user workstations to untrusted external hosts shortly after a MongoDB client launch.

Detection Strategies

Inventory hosts running MongoDB Schema Manager and the MongoDB Atlas SQL ODBC Driver, then correlate their versions with the fixed releases in the MongoDB SQL Interface Changelog.
Alert on child processes of MongoDB client tooling that invoke rundll32.exe, cmd.exe, powershell.exe, open, or handlers for file://, smb://, and ldap:// URIs.
Monitor HTTPS traffic from client hosts to .well-known/openid-configuration endpoints on unapproved domains.

Monitoring Recommendations

Capture and retain process lineage and command-line telemetry from workstations that run BI or analytics tools using the Atlas SQL ODBC Driver.
Log DNS and TLS SNI values for connections that follow OIDC discovery requests to detect redirection to attacker infrastructure.
Ingest MongoDB client and driver logs into a central analytics platform to review authentication mechanism selection and issuer URLs.

How to Mitigate CVE-2026-19503

Immediate Actions Required

Upgrade MongoDB Schema Manager and the MongoDB Atlas SQL ODBC Driver to the fixed versions listed in the MongoDB SQL Interface Changelog.
Restrict MONGODB-OIDC authentication to trusted, controlled MongoDB deployments only.
Audit connection strings distributed to developers and analysts to confirm they reference approved cluster hostnames.

Patch Information

MongoDB has published fixed builds for both components. Refer to the MongoDB SQL Interface Changelog for the specific released versions that validate OIDC discovery endpoint schemes and reject non-HTTPS URLs.

Workarounds

Disable the MONGODB-OIDC authentication mechanism on client hosts that cannot immediately upgrade.
Block outbound connections from workstations to arbitrary MongoDB endpoints using host or network firewall policies.
Remove or restrict OS-level protocol handlers for file://, smb://, and ldap:// on managed workstations.

bash

# Example: block outbound MongoDB wire protocol traffic except to approved hosts
# Linux nftables example
nft add rule inet filter output tcp dport 27017 ip daddr != {10.0.0.0/8, 192.168.0.0/16} drop

# Verify installed driver version (Windows PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\ODBC\ODBCINST.INI\MongoDB Atlas SQL ODBC Driver" | Select-Object DriverVersion