CVE-2026-19503mediumCWE-20

CVE-2026-19503: medium-severity vulnerability in MongoDB Atlas SQL ODBC Driver

Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

Published · Updated

Follow this CVE+ Monitor Atlas SQL ODBC Driver+ Monitor Schema Builder CLI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.2%
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
MongoDB · Atlas SQL ODBC DriverMongoDB · Schema Builder CLI
Related CVEs — MongoDB Atlas SQL ODBC Driver

In the same product, most dangerous first.

CVE-2026-120952MEDIUMMongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds writeEPSS 0.4%CVE-2026-19502MEDIUMInsufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLIEPSS 0.2%