CVE-2026-76798

Awaiting Analysis Awaiting Analysis - Queue

MongoDB BI Connector Log Report HTML Injection Vulnerability

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that report in a browser is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-76798

EUVD

EUVD-2026-67778

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongo_sql_transition_readiness_tool	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves the MongoSQL Transition Readiness Tool writing unencoded query text and usernames from BI Connector logs into an HTML report. An attacker can inject markup into queries that gets interpreted by the browser when the report is opened, potentially exposing other users' logged data or misleading the operator.

Detection Guidance

Check MongoSQL Transition Readiness Tool logs for suspicious query text or user names that may contain HTML markup. Review generated HTML reports for unencoded content that could indicate exploitation.

Impact Analysis

If you generate or open a report from logs containing affected entries, an attacker could access sensitive information like other users' queries or usernames. They could also manipulate the report content to deceive you with misleading information.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches if sensitive query text or user information is disclosed to unauthorized parties.

Mitigation Strategies

Update the MongoSQL Transition Readiness Tool to a patched version. Disable report generation from logs containing untrusted query text. Implement input validation for BI Connector queries to prevent malicious markup.

Hi! I’m here to help you understand CVE-2026-76798. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70