CVE-2026-19502: mongodb sql schema builder cli

csirt@kutim:~/threat-intel/cve/CVE-2026-19502

CVSS 5.5 · Medium EPSS 0,12%

Kerentanan Insertion of Sensitive Information into Log File pada mongodb sql schema builder cli. Skor CVSS 3.1 5.5 (Medium) menurut mongodb.com.

Deskripsi (NVD)

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.

Rincian

Terbit di NVD: 12 Agustus 2026
Terakhir diubah: 29 September 2026
Status NVD: Analyzed
CVSS 3.1: 5.5 (Medium), sumber mongodb.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-532: Insertion of Sensitive Information into Log File
EPSS (30 hari): 0,12% peluang dieksploitasi; lebih tinggi dari 1,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mongodb	sql schema builder cli	Versi 1.0.1 hingga sebelum 1.2.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.mongodb.com/docs/sql-interface/changelog release notes · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.