MongoDB BI Connector CVE-2026-18888

Exploitation requires two concurrent conditions: the attacker must have write access to at least one MongoDB collection that is configured for exposure through the BI Connector, and a client application must actively read that collection via the ODBC driver with a field type mapped to text. The attacker inserts a document containing a sufficiently large floating-point value; exploitation is then triggered passively when the victim application performs a read. Limiting factors include the PR:L requirement (MongoDB collection write privileges, typically held by application accounts and data engineers but not anonymous users), the necessity of an active BI Connector deployment with the specific collection in scope, and the impact being confined to crashing the ODBC-connected client application rather than the MongoDB server itself. Non-default deployment of the BI Connector is itself a prerequisite, as this component is separate from core MongoDB.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores this at 7.1, reflecting network-reachable exploitation by a low-privileged attacker with no complexity barrier, yielding high availability impact. The scored impact is application crash rather than code execution, and there is no confidentiality or integrity component. Critically, exploitation is gated on the attacker having MongoDB collection write access - a meaningful real-world constraint that distinguishes this from an unauthenticated remote attack. No EPSS score was provided in the available intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The memory corruption primitive theoretically permits more severe outcomes than a crash alone, but that escalation path is unconfirmed by available data. Even a mid-sized municipal IT team in walbrzych running MongoDB-backed BI infrastructure should treat this as a prompt remediation priority, since write-level MongoDB users - including application service accounts and data engineers - represent a realistic attacker population in typical deployments. The overall risk profile is moderate: the DoS is real, the upgrade path is straightforward, and no compensating control fully neutralizes it.

An authenticated MongoDB user with write access to a collection exposed via the BI Connector inserts a document containing an extreme floating-point value - such as a very large finite float or a special value whose string representation exceeds the driver's fixed staging buffer. When a BI application subsequently queries that collection through the ODBC driver and retrieves the field as text, the driver's conversion routine writes beyond the destination buffer, corrupting adjacent memory and crashing the client application. No public exploit code has been identified at time of analysis, but the trigger condition is mechanically straightforward for any user with the required data-write privilege.