BI Connector vulnerabilities

6 known vulnerabilities in BI Connector from MongoDB. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  BI Connector: Synchronous Access of Remote Resource without Timeout

  CVE-2026-81520Aug 28, 2026MongoDB

  A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time

• 7.5 High severity

  BI Connector: Improper Certificate Validation

  CVE-2026-81518Aug 28, 2026MongoDB

  When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client

• 7.5 High severity

  BI Connector: Uncaught Exception

  CVE-2026-81517Aug 28, 2026MongoDB

  An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequent

• 7.7 High severity

  BI Connector: NULL Pointer Dereference

  CVE-2026-81490Aug 28, 2026MongoDB

  A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message

• 8.0 High severity

  BI Connector: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-77586Aug 28, 2026MongoDB

  In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to

• 7.5 High severity

  BI Connector: Double Free

  CVE-2026-75159Aug 27, 2026MongoDB

  An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can inter