MongoDB SQL Schema Builder CLI vulnerabilities

2 CVEs affecting MongoDB SQL Schema Builder CLI, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19503, published 2026-08-12.

More from MongoDB.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-19503, published 2026-08-12. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect…
• CVE-2026-19502, published 2026-08-12. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without…