CVE-2026-19503 Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
Attackers can trigger local protocol handlers via malicious OIDC endpoints, potentially exposing credentials or executing code in the user's context.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19503?
CVE-2026-19503 is a medium-severity server-side request forgery vulnerability in MongoDB Atlas SQL ODBC Driver, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
Weakness: CWE-20
Which versions are affected by CVE-2026-19503?
It affects 2 products.
Products include Mongodb Odbc Driver, Mongodb Sql Schema Builder Cli.
How do I fix CVE-2026-19503?
No fix has been published for CVE-2026-19503 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-19503 being exploited?
There is no known exploitation of CVE-2026-19503 in the wild and no public exploit code.
Sources
Also known as GHSA-gxxm-9rmv-h4mp, UBUNTU-CVE-2026-19503.