What’s Vulnerable › Vulnerabilities
CVE-2026-19503: Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-12 · updated 2026-09-29
- Weakness: CWE-20
Description
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
Affected products
- MongoDB Odbc Driver: from 1.0.0 before 2.0.9 — fixed in 2.0.9
- MongoDB Schema Builder CLI: from 1.0.1 before 1.2.1 — fixed in 1.2.1
How to fix
Upgrade to a fixed version: MongoDB Odbc Driver 2.0.9; MongoDB Schema Builder CLI 1.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19503 or the next vulnerability affects your stack