MongoDB SQL Schema Builder CLI emits its configuration parameters to standard output during startup, and when file logging is enabled, to a local log file. Affected connection settings—including authentication materials supplied by an operator—are written without redaction. This weakness allows an attacker to read such credentials from the terminal session or from the log file. The flaw is a classic example of CWE‑532, where configuration or other sensitive information is exposed through logging mechanisms, resulting in potential compromise of authentication secrets.

The vulnerability affects the MongoDB Schema Builder CLI utility. No specific version information is listed in the CNA data, but any deployment that uses the CLI with default or configured logging is susceptible.

The CVSS base score of 6.8 indicates medium severity. EPSS is not available, so the precise likelihood of exploitation is unknown, but the potential impact of credential leakage is significant. The vulnerability is not listed in the CISA KEV catalog, so it may not be a currently actively exploited flaw, but the information disclosure remains a serious risk to any system that logs CLI output with sensitive data. The attack vector is local; a user with read access to the terminal session, log directory, or any place where the generated logs are collected can obtain the credentials.