EUVD-2026-57549
GHSA-wx8h-2jpv-xvwr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low-privilege OS access required; impact is confidentiality-only via passive read of unredacted log or terminal output.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
AnalysisAI
Plaintext credential exposure in MongoDB SQL Schema Builder CLI allows local users to read authentication material from diagnostic output or log files. The CLI writes its startup configuration - including connection settings containing authentication credentials - to standard output and optionally to a log file on disk without redacting sensitive values. Any local user with read access to the terminal session, the log directory, or a downstream log aggregation system can harvest those credentials and use them to authenticate to the connected MongoDB instance.
Technical ContextAI
The MongoDB SQL Schema Builder CLI (CPE: cpe:2.3:a:mongodb:schema_builder_cli:*:*:*:*:*:*:*:*) is a command-line tool within MongoDB's SQL interface layer, used by operators to configure and manage schema mappings. CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: the application logs its runtime configuration at startup - a common observability pattern - but fails to redact or mask authentication-bearing fields such as connection strings, usernames, or passwords before writing them to stdout or the configured log destination. This class of flaw is particularly dangerous because log files often have broader read permissions than the application's runtime secrets, are frequently shipped to centralized log aggregators (SIEM, Splunk, ELK), and may be retained for extended periods, dramatically expanding the attack surface beyond the immediate host.
RemediationAI
Consult the MongoDB SQL interface changelog at https://www.mongodb.com/docs/sql-interface/changelog for the specific patched version and upgrade immediately. Until a confirmed fixed version is identified and applied, operators should rotate any credentials that may have been written to logs or terminal output since the CLI was first deployed - assume those values are compromised. As an immediate compensating control, restrict log file permissions to the owning service account only (chmod 600 or equivalent) and audit log forwarding pipelines to ensure CLI log files are excluded from shipment to centralized aggregators. If file logging is not required, disable it via the CLI's logging configuration to eliminate the on-disk exposure path. Note that disabling file logging does not eliminate the stdout exposure path if the terminal session is shared or recorded. No specific workaround eliminates the stdout path other than piping output to /dev/null, which would also suppress legitimate diagnostic information.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today