Read the docs
TI-2026-56241 Aliases CVE-2026-81520GHSA-435g-jwv8-462q

MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion

Priority MEDIUM 44CWE-1088Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed BI Connector (MongoDB): 2.14.31

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBBI Connectorbefore 2.14.312.14.31Patch availableCNA
  • BI Connector VendorMongoDB Affected before 2.14.31 Fixed in 2.14.31 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:bi_connector:*:*:*:*:*:*:*:*before 2.14.31VulnerableMongoDB
  • cpe:2.3:a:mongodb:bi_connector:*:*:*:*:*:*:*:* Versions before 2.14.31 Vulnerable ·MongoDB

Remediation

  • Fix · CNA BI Connector (MongoDB) Fixed in 2.14.31

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB BI Connector 2.14.31

    6 records Highest priority Priority MEDIUM 3 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-56239 MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL ServicePriority MEDIUM 44
    • TI-2026-56240 BI Connector Optional Client Certificate Verification Allows Unauthenticated ConnectionsPriority MEDIUM 43
    • TI-2026-54087 MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE OutputPriority LOW 39
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81520
  2. 2026-10-03 Alias added: GHSA-435g-jwv8-462q

References

Advisory 1

  • TI-2026-56239 MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service CVSS 4.0HIGH 8.7
  • TI-2026-56240 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections CVSS 4.0HIGH 8.7
  • TI-2026-54087 MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output CVSS 4.0HIGH 8.5
  • TI-2026-56233 MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service CVSS 4.0HIGH 8.3
  • TI-2026-52807 MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination CVSS 4.0HIGH 8.2
  • TI-2026-53906 MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output CVSS 4.0MEDIUM 5.6
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences