MongoDB: 20 Vulnerabilities in BI Connector, Drivers Disclosed Together
MongoDB disclosed 20 vulnerabilities in its BI Connector, drivers, and services, ranging from High to Medium severity, patched by the vendor.
Key findings
- 20 vulnerabilities disclosed across MongoDB Connector for BI, multiple drivers, and core services.
- High-severity flaws include memory-safety issues, authentication bypass, and denial-of-service vectors.
- Multiple drivers (C#, PHP, Rust, C, C++, Go) affected by input validation and namespace handling flaws.
- Vulnerabilities disclosed between August 27-28, 2026, and have been patched by MongoDB.
- Patching is crucial for all affected MongoDB deployments to mitigate risks.
On August 27-28, 2026, MongoDB disclosed a batch of 20 vulnerabilities affecting various components of its data platform, including the Connector for BI, C# Driver, Rust Driver, PHP client library, C Driver, libmongocrypt, C++ Driver, Go Driver, and the core mongosqld service. These vulnerabilities, ranging in severity from Medium to High, primarily stem from improper handling of user-supplied input, leading to issues such as memory-safety problems, denial-of-service conditions, and potential information disclosure.
Several vulnerabilities were identified within the MongoDB Connector for BI (mongosqld). CVE-2026-81533 and CVE-2026-81532 highlight memory-safety issues in the ODBC driver related to SQL statement parsing and cursor name handling, respectively. CVE-2026-81520 describes an authentication session vulnerability where an unauthenticated client can hold a session open indefinitely. Additionally, CVE-2026-81517 points to a denial-of-service risk where routine connection log activity could exhaust storage, leading to service interruption. CVE-2026-81490 details how a malicious database user could create a view that disrupts the schema-sampling routine, and CVE-2026-77586 warns of potential SQL injection via crafted collection names in SHOW CREATE statements. CVE-2026-75159 presents a denial-of-service vulnerability in the BI Connector's Kerberos authentication handling.
The MongoDB C# Driver is affected by multiple issues. CVE-2026-81530 involves the improper masking of key-management credential material in diagnostic logs. CVE-2026-81529 allows for connection-option injection due to improper neutralization of delimiters in connection URLs. CVE-2026-81528 permits document-replacement operations to forward unneutralized query-language elements to the server. CVE-2026-81527 describes a NoSQL/expression injection weakness in the LINQ-to-aggregation query translation layer.
Other drivers and components also saw vulnerabilities disclosed. The MongoDB Rust Driver (CVE-2026-81526), PHP client library (CVE-2026-81525), C Driver (CVE-2026-81524), C++ Driver (CVE-2026-81522), and Go Driver (CVE-2026-81521) all suffer from weaknesses in handling caller-supplied namespace or database identifiers, potentially leading to operations being misdirected. CVE-2026-81523 in libmongocrypt involves a missing input-validation issue that could lead to incorrect schema selection. CVE-2026-75573 notes that a TLS private-key password might be written to standard error when supplied via both connection URI and command-line option in mongodrdl.
The vulnerabilities were disclosed on August 27 and 28, 2026. MongoDB has released patches for these issues. Users are advised to consult MongoDB's security advisories for specific version information and apply the necessary updates to mitigate these risks. The broad range of affected components underscores the importance of secure coding practices across the entire MongoDB ecosystem.
The timely disclosure and patching of these vulnerabilities by MongoDB demonstrate a commitment to security. However, the sheer number of CVEs and the variety of affected components highlight the complexity of securing large database systems and the persistent threat posed by input validation flaws. Users should prioritize updating their MongoDB deployments to the latest versions to protect against these newly disclosed security weaknesses.
Key findings include memory-safety issues in the BI Connector's ODBC driver, authentication bypass and denial-of-service vectors in the BI Connector, and various injection and data-handling flaws across multiple MongoDB drivers (C#, PHP, Rust, C, C++, Go). The vulnerabilities were patched by MongoDB shortly after disclosure.
The batch of vulnerabilities spans several MongoDB products, including the Connector for BI, C# Driver, Rust Driver, PHP client library, C Driver, libmongocrypt, C++ Driver, Go Driver, and mongosqld. The issues were disclosed between August 27-28, 2026.
The vulnerabilities were addressed by MongoDB through patches. Users should refer to MongoDB's official security advisories for detailed information on affected versions and remediation steps.
This batch of vulnerabilities underscores the critical need for robust input validation and secure handling of user-supplied data across all components of the MongoDB ecosystem. The timely patching by MongoDB is a positive step, but ongoing vigilance and prompt application of updates are essential for maintaining a secure environment.