Skip to main content

MongoDB BI Connector CVE-2026-81517

| EUVDEUVD-2026-67933 HIGH
Uncaught Exception (CWE-248)
2026-08-28 mongodb GHSA-87fw-525c-9h5m
Information Disclosure Bi Connector
8.7
CVSS 4.0 · Vendor: mongodb
Share

Severity by source

Vendor (mongodb) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable with no authentication or complexity; sole impact is availability of the mongosqld process with no scope change to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 28, 2026 - 23:03 EUVD
Analysis Generated
Aug 28, 2026 - 22:25 vuln.today
CVE Published
Aug 28, 2026 - 20:14 cve.org
HIGH 8.7

DescriptionCVE.org

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequently fails, the resulting error is not handled and the shared mongosqld process ends, ending service for all connected SQL clients. The process continues to end on startup until an operator restores available storage, and the diagnostic message explaining the condition is not recorded.

AnalysisAI

Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shared process by generating sufficient connection log volume to fill the configured log path's backing storage. When a subsequent log write or rotation operation fails, an uncaught exception (CWE-248) terminates the mongosqld process, immediately denying SQL service to all connected clients. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required and no special product configuration is needed beyond the default logging behavior enabled in all mongosqld deployments. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects a trivially exploitable network denial-of-service with no mitigating complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult the MongoDB BI Connector release notes at https://www.mongodb.com/docs/bi-connector/current/release-notes/ and upgrade to the version identified as containing the fix - no specific patched version number is confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: implement network ACLs to restrict mongosqld access to authorized clients only and configure log rotation with strict file size limits to constrain disk space consumption. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Bi Connector

View all
CVE-2026-81520 HIGH
8.7 Aug 28

Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentica
CVE-2026-81518 HIGH
8.7 Aug 28

Mongosqld in the MongoDB BI Connector requests but does not enforce client certificates during the TLS handshake when co
CVE-2026-77586 HIGH
8.5 Aug 28

SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft

CVE-2026-81490 HIGH
8.3 Aug 28

Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt

CVE-2026-75159 HIGH
8.2 Aug 27

Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly config
CVE-2026-77184 MEDIUM
5.7 Aug 28

SQL injection in MongoDB Connector for BI allows a high-privilege user to embed arbitrary SQL in generated DDL output by
CVE-2026-75573 MEDIUM
4.1 Aug 27

MongoDB BI Connector's mongodrdl tool leaks TLS private-key passwords to standard error when the password is simultaneou

Same weakness CWE-248 – Uncaught Exception

View all
CVE-2013-10065 HIGH POC
8.7
CVE-2026-62909 HIGH POC
7.8
CVE-2023-0790 HIGH POC
8.8
CVE-2026-53530 HIGH POC
8.7
CVE-2024-8249 HIGH POC
7.5
CVE-2024-8020 HIGH POC
7.5
CVE-2025-59538 HIGH POC
7.5
CVE-2026-34986 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-81517 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy