CVE-2026-19503mediumCWE-20

CVE-2026-19503: falha de média gravidade em MongoDB Atlas SQL ODBC Driver

Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Atlas SQL ODBC Driver+ Monitorar Schema Builder CLI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.2%
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · Atlas SQL ODBC DriverMongoDB · Schema Builder CLI
CVEs relacionadas — MongoDB Atlas SQL ODBC Driver

No mesmo produto, das mais perigosas para as menos.

CVE-2026-120952MEDIUMMongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds writeEPSS 0.4%CVE-2026-19502MEDIUMInsufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLIEPSS 0.2%