CVE-2026-81520: high-severity vulnerability in MongoDB BI Connector
MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.4%
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
MongoDB · BI ConnectorRelated CVEs — MongoDB BI Connector
In the same product, most dangerous first.
CVE-2026-75159HIGHMongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process TerminationEPSS 0.5%CVE-2026-81490HIGHMongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL ServiceEPSS 0.5%CVE-2026-81517HIGHMongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL ServiceEPSS 0.5%CVE-2026-77586HIGHMongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE OutputEPSS 0.4%CVE-2026-77184MEDIUMMongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE OutputEPSS 0.3%CVE-2026-81518HIGHBI Connector Optional Client Certificate Verification Allows Unauthenticated ConnectionsEPSS 0.3%