TI-2026-56239 Aliases CVE-2026-81517 GHSA-87fw-525c-9h5m

MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service

MEDIUM 44CWE-248Published 2026-08-28 · Updated 2026-08-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequently fails, the resulting error is not handled and the shared mongosqld process ends, ending service for all connected SQL clients. The process continues to end on startup until an operator restores available storage, and the diagnostic message explaining the condition is not recorded.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0046 40th percentileScored 2026-11-07

Fix Fixed BI Connector (MongoDB): 2.14.31

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MongoDB	BI Connector	before 2.14.31	2.14.31	Patch available	CNA

BI Connector VendorMongoDB Affected before 2.14.31 Fixed in 2.14.31 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mongodb:bi_connector::::::::	before 2.14.31	Vulnerable	MongoDB

cpe:2.3:a:mongodb:bi_connector:*:*:*:*:*:*:*:* Versions before 2.14.31 Vulnerable ·MongoDB

Remediation

Fix · CNA BI Connector (MongoDB) Fixed in 2.14.31

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-28
MongoDB BI Connector 2.14.31
6 records Highest priority Priority MEDIUM 3 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-56241 MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection ExhaustionPriority MEDIUM 44
- TI-2026-56240 BI Connector Optional Client Certificate Verification Allows Unauthenticated ConnectionsPriority MEDIUM 43
- TI-2026-54087 MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE OutputPriority LOW 39
Show all 6 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-81517
2026-10-03 Alias added: GHSA-87fw-525c-9h5m

References

Advisory 1

https://www.mongodb.com/docs/bi-connector/current/release-notes/

TI-2026-56241 MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion CVSS 4.0HIGH 8.7
TI-2026-56240 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections CVSS 4.0HIGH 8.7
TI-2026-54087 MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output CVSS 4.0HIGH 8.5
TI-2026-56233 MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service CVSS 4.0HIGH 8.3
TI-2026-52807 MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination CVSS 4.0HIGH 8.2
TI-2026-53906 MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output CVSS 4.0MEDIUM 5.6

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences