What is GHSA-gxxm-9rmv-h4mp?

GHSA-gxxm-9rmv-h4mp is a security advisory published by GitHub Security Advisories with Medium severity. MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the...

Which CVE IDs does GHSA-gxxm-9rmv-h4mp cover?

GHSA-gxxm-9rmv-h4mp covers the following CVE IDs: CVE-2026-19503. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gxxm-9rmv-h4mp?

GHSA-gxxm-9rmv-h4mp has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-gxxm-9rmv-h4mpMediumCVSS 4.8

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the...

Vendor

GitHub Security Advisories

Published

August 12, 2026

Last Modified

August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-19503 →

📋 Description

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-19503
https://www.mongodb.com/docs/sql-interface/changelog
https://github.com/advisories/GHSA-gxxm-9rmv-h4mp