Unrated

UBUNTU-CVE-2026-19503

Type: advisorySource: OSV1 source record

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

Announced 12 Aug 2026Group revision 1

Original source ↗

UBUNTU-CVE-2026-19503

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2026-19503

mongodb

Source reference: /affected/0/package/name

Affected versions: 1:2.4.6-0ubuntu5
Source reference: /affected/0/versions
1:2.4.6-0ubuntu6
Source reference: /affected/0/versions
1:2.4.8-1ubuntu1
Source reference: /affected/0/versions
1:2.4.8-2
Source reference: /affected/0/versions
1:2.4.9-1
Source reference: /affected/0/versions
1:2.4.9-1ubuntu1
Source reference: /affected/0/versions
1:2.4.9-1ubuntu2
Source reference: /affected/0/versions
1:2.4.9-1ubuntu2+esm2
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

mongodb

Source reference: /affected/1/package/name

Affected versions: 1:2.6.10-0ubuntu1
Source reference: /affected/1/versions
1:2.6.10-0ubuntu1+esm2
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

mongodb

Source reference: /affected/2/package/name

Affected versions: 1:3.4.7-1
Source reference: /affected/2/versions
1:3.4.7-1ubuntu1
Source reference: /affected/2/versions
1:3.4.7-1ubuntu2
Source reference: /affected/2/versions
1:3.4.7-1ubuntu4
Source reference: /affected/2/versions
1:3.4.14-3ubuntu1
Source reference: /affected/2/versions
1:3.4.14-3ubuntu2
Source reference: /affected/2/versions
1:3.6.3-0ubuntu1
Source reference: /affected/2/versions
1:3.6.3-0ubuntu1.1
Source reference: /affected/2/versions
1:3.6.3-0ubuntu1.3
Source reference: /affected/2/versions
1:3.6.3-0ubuntu1.4
Source reference: /affected/2/versions
1:3.6.3-0ubuntu1.4+esm1
Source reference: /affected/2/versions
1:3.6.3-0ubuntu1.4+esm2
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

mongodb

Source reference: /affected/3/package/name

Affected versions: 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2
Source reference: /affected/3/versions
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5
Source reference: /affected/3/versions
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2
Source reference: /affected/3/versions
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3
Source reference: /affected/3/versions
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1
Source reference: /affected/3/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongodb",
      "purl": "pkg:deb/ubuntu/mongodb?arch=source&distro=esm-infra-legacy%2Ftrusty",
      "ecosystem": "Ubuntu:Pro:14.04:LTS"
    },
    "versions": [
      "1:2.4.6-0ubuntu5",
      "1:2.4.6-0ubuntu6",
      "1:2.4.8-1ubuntu1",
      "1:2.4.8-2",
      "1:2.4.9-1",
      "1:2.4.9-1ubuntu1",
      "1:2.4.9-1ubuntu2",
      "1:2.4.9-1ubuntu2+esm2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19503.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "mongodb",
          "binary_version": "1:2.4.9-1ubuntu2+esm2"
        },
        {
          "binary_name": "mongodb-clients",
          "binary_version": "1:2.4.9-1ubuntu2+esm2"
        },
        {
          "binary_name": "mongodb-server",
          "binary_version": "1:2.4.9-1ubuntu2+esm2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongodb",
      "purl": "pkg:deb/ubuntu/mongodb?arch=source&distro=esm-apps%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "1:2.6.10-0ubuntu1",
      "1:2.6.10-0ubuntu1+esm2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19503.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "mongodb",
          "binary_version": "1:2.6.10-0ubuntu1+esm2"
        },
        {
          "binary_name": "mongodb-clients",
          "binary_version": "1:2.6.10-0ubuntu1+esm2"
        },
        {
          "binary_name": "mongodb-server",
          "binary_version": "1:2.6.10-0ubuntu1+esm2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongodb",
      "purl": "pkg:deb/ubuntu/mongodb?arch=source&distro=esm-apps%2Fbionic",
      "ecosystem": "Ubuntu:Pro:18.04:LTS"
    },
    "versions": [
      "1:3.4.7-1",
      "1:3.4.7-1ubuntu1",
      "1:3.4.7-1ubuntu2",
      "1:3.4.7-1ubuntu4",
      "1:3.4.14-3ubuntu1",
      "1:3.4.14-3ubuntu2",
      "1:3.6.3-0ubuntu1",
      "1:3.6.3-0ubuntu1.1",
      "1:3.6.3-0ubuntu1.3",
      "1:3.6.3-0ubuntu1.4",
      "1:3.6.3-0ubuntu1.4+esm1",
      "1:3.6.3-0ubuntu1.4+esm2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19503.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "mongodb",
          "binary_version": "1:3.6.3-0ubuntu1.4+esm2"
        },
        {
          "binary_name": "mongodb-clients",
          "binary_version": "1:3.6.3-0ubuntu1.4+esm2"
        },
        {
          "binary_name": "mongodb-server",
          "binary_version": "1:3.6.3-0ubuntu1.4+esm2"
        },
        {
          "binary_name": "mongodb-server-core",
          "binary_version": "1:3.6.3-0ubuntu1.4+esm2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mongodb",
      "purl": "pkg:deb/ubuntu/mongodb?arch=source&distro=esm-apps%2Ffocal",
      "ecosystem": "Ubuntu:Pro:20.04:LTS"
    },
    "versions": [
      "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2",
      "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5",
      "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2",
      "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3",
      "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19503.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "mongodb",
          "binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
        },
        {
          "binary_name": "mongodb-clients",
          "binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
        },
        {
          "binary_name": "mongodb-server",
          "binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
        },
        {
          "binary_name": "mongodb-server-core",
          "binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #51942 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 14:36:30 GMT
Publisher date: Wed, 12 Aug 2026 21:17:00 GMT

Read the original announcement

Revision history

25 Oct 2026UBUNTU-CVE-2026-19503 · Revision 1Source updated