Executive brief
MongoDB's SQL Schema Builder CLI tool writes authentication credentials and connection settings to startup logs without masking sensitive data. When file logging is enabled, these credentials appear in plaintext in both terminal output and log files on disk. Local users or anyone with access to logs stored elsewhere could extract database authentication material, potentially leading to unauthorized database access.
Technical details
The vulnerability is an information disclosure issue in MongoDB SQL Schema Builder CLI where startup configuration—including unredacted authentication credentials and connection parameters—is written to standard output and optionally to disk log files. The root cause is insufficient redaction of sensitive configuration data during diagnostic output generation. Attack vector is local: an attacker needs file system access to read terminal session history or log directories where diagnostic output is stored. No authentication bypass is required; the vulnerability simply exposes credentials that could be used in subsequent attacks. The fix involves redacting sensitive fields (passwords, API keys, connection strings with embedded credentials) before writing configuration data to logs.
Affected products
- MongoDB SQL Schema Builder CLI
Timeline
- 2026-08-12: disclosed