MongoDB Schema Builder CLI EUVD-2026-57549

Exploitation requires local access to the host running the MongoDB SQL Schema Builder CLI with at least a low-privilege OS account (CVSS PR:L, AV:L). The log file attack path additionally requires that file logging be enabled in the CLI configuration and that the attacker have filesystem read access to the log directory - which may be granted by default group permissions or misconfigured ACLs. The terminal session attack path requires the attacker to share the terminal or have access to terminal session recordings. Exploitation is further extended - without requiring additional privileges - if log files are forwarded to any centralized system accessible to a broader audience. Exploitation does not require network access, special tooling, or any interaction from the operator after startup.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately captures the threat model: exploitation is local, requires only low-privilege access, and yields high confidentiality impact with no integrity or availability consequence. The primary risk amplifier is log forwarding - if the CLI's log files are shipped to a centralized system, the effective attack surface expands from a single host to anyone with access to that aggregation platform. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, so opportunistic mass exploitation is not a current concern. EPSS data was not provided in the input. Despite the moderate CVSS score, organizations running the SQL Schema Builder CLI in environments with shared local accounts, centralized log collection, or multi-tenant infrastructure should treat credential rotation as urgent, since exposed credentials grant direct database access independent of this CLI. No signals conflict in this case - the local vector, low privilege requirement, and confidentiality-only impact are mutually consistent and well-supported by the description.

An operator starts the MongoDB SQL Schema Builder CLI with database credentials supplied as connection string arguments or environment-sourced configuration; the CLI prints the startup configuration - including those credentials in plaintext - to the terminal and to its log file. A second local user on the same host, or an analyst with access to a SIEM where those logs were forwarded, reads the log file and extracts the MongoDB username and password. No public exploit code is required; this is a passive read of accessible files.