EUVD-2026-67934
GHSA-2r33-wv3m-hvxf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no credentials required once reachable; pure confidentiality impact as the flaw grants read access only, with no data modification or availability disruption.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.
AnalysisAI
Mongosqld in the MongoDB BI Connector requests but does not enforce client certificates during the TLS handshake when configured with a CA file, silently accepting connections from clients that present no certificate at all. Deployments that rely on client certificate authentication as the sole means of identifying users are fully exposed - any remote party with network access to the listener can establish a session and read all MongoDB data surfaced through the SQL interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific non-default configuration conditions must coexist: (1) mongosqld must be configured with a client certificate authority file (e.g., net.tls.CAFile is explicitly set), which is not a default deployment state; and (2) client certificate authentication must be the sole mechanism for identifying and authenticating users - meaning no supplemental username/password, LDAP, or other credential layer is configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores this at 8.7 and accurately reflects the severity for deployments meeting the exploitation conditions - network-reachable, trivially exploited, requiring no credentials, with full confidentiality impact on exposed data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the MongoDB BI Connector to the patched version identified in the official release notes at https://www.mongodb.com/docs/bi-connector/current/release-notes/ - no specific fixed version number was confirmed in the available intelligence and must be verified directly before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Mongosqld deployments to identify those configured with CA file and client certificate requirements; implement firewall rules to restrict the listener port to internal networks only, blocking all external access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bi Connector
View allUnauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentica
Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shar
SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft
Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly config
SQL injection in MongoDB Connector for BI allows a high-privilege user to embed arbitrary SQL in generated DDL output by
MongoDB BI Connector's mongodrdl tool leaks TLS private-key passwords to standard error when the password is simultaneou
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today