CVE-2026-19502

The CVSS 5.5 score is misleading — this is plaintext credential leakage, and the severity metric fundamentally understates the real risk. The MongoDB SQL Schema Builder CLI writes operator-supplied authentication material (connection strings, credentials, or TLS settings) to stdout and log output as part of its startup diagnostic behavior. The tool was explicitly designed to log startup configuration for debugging purposes, and the developers simply failed to exclude sensitive fields from that output. The attack path is local-only, which is why EPSS is low at 0.00113. But EPSS doesn't capture what happens after the credentials hit disk: they propagate into log aggregation pipelines, SIEM ingestion, centralized logging services, backup systems, and every analyst with pipeline access. The filesystem permission model CVSS assumes doesn't apply inside Splunk, Datadog, or cloud logging endpoints. Once plaintext credentials enter a log pipeline with multi-year retention, the attack surface compounds over time — a credential logged today might be accessible in an AI analytics query or by a future employee with broad SIEM permissions next year. For defenders: audit your log aggregation pipelines for MongoDB Schema Builder CLI output. Check SIEM ingestion, centralized logging, and backup systems for plaintext credentials from this tool. If you operate this CLI in any environment, treat any credentials used there as compromised — operators frequently reuse credentials across test, staging, and production, making a staging credential leak a meaningful pivot point. Rotate those credentials immediately and review your log retention policies. Two questions remain open: whether MongoDB's fix redacts sensitive values entirely or moves them to a separate access-controlled channel, and whether other MongoDB CLI tools use the same logging framework — if so, this vulnerability class likely exists elsewhere in the product line. The design question underlying this CVE is whether diagnostic logging of startup configuration should exist at all when credentials are involved, or whether the right answer is logging configuration state without credentials and accepting that credential-related debugging requires a different workflow.

Reviewed through automated stages and approved by a human before publication.