Skip to content
OpenAdvisories
High WID-SEC-2026-3082 8 CVEs

MongoDB BI Connector und ODBC Driver: Mehrere Schwachstellen

Published Aug 30, 2026 · Updated Aug 30, 2026 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um beliebigen Code auszuführen, SQL-Injection-Angriffe durchzuführen, die Authentifizierung zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 8

  • High 8.8
    CVE-2026-81532

    BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption

    A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the d…

    MongoDB BI Connector ODBC Driver
  • High 8.0
    CVE-2026-77586

    MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output

    In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write t…

    MongoDB BI Connector
  • High 7.7
    CVE-2026-81490

    MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service

    A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message…

    MongoDB BI Connector
  • High 7.5
    CVE-2026-81517

    MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service

    An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequen…

    MongoDB BI Connector
  • High 7.5
    CVE-2026-81518

    BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

    When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client…

    MongoDB BI Connector
  • High 7.5
    CVE-2026-81520

    MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion

    A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time…

    MongoDB BI Connector
  • High 7.1
    CVE-2026-81533

    MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values

    An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional pr…

    MongoDB BI Connector ODBC Driver
  • Medium 5.2
    CVE-2026-77184

    MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output

    In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a…

    MongoDB BI Connector

Revision history

  1. #1

    Initiale Fassung

References