CVE-2026-81518: fallo de gravedad alta en MongoDB BI Connector
BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.3%
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
MongoDB · BI ConnectorCVEs relacionadas — MongoDB BI Connector
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-75159HIGHMongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process TerminationEPSS 0.5%CVE-2026-81490HIGHMongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL ServiceEPSS 0.5%CVE-2026-81517HIGHMongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL ServiceEPSS 0.5%CVE-2026-77586HIGHMongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE OutputEPSS 0.4%CVE-2026-81520HIGHMongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection ExhaustionEPSS 0.4%CVE-2026-77184MEDIUMMongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE OutputEPSS 0.3%