MongoDB Schema Builder CLI version 1.0.0 logs its startup configuration including connection settings to standard output and log files on disk. Some authentication material supplied by the operator is written without redaction, resulting in sensitive information being stored in plaintext within diagnostic logs. This exposure allows a local user with read access to the terminal session or log directory, or any party with access to collected logs, to obtain authentication credentials. The vulnerability is identified as CWE-532 (Insertion of sensitive information into log file). There is no vendor advisory or patch information currently available.

Exposure of authentication credentials in plaintext logs can lead to unauthorized access if an attacker gains read access to the terminal session or log files. This risk is limited to local users or those with access to log storage locations. There is no indication of remote exploitation or privilege escalation beyond the ability to read logs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to terminal sessions and log directories to trusted users only. Avoid enabling file logging if possible or ensure logs are stored securely with strict access controls.