CVE-2026-81490

Analyzed Analyzed - Analysis Complete

MongoDB Connector for BI Schema Sampling Failure

Publication date: 2026-08-28

Last updated on: 2026-09-29

Assigner: MongoDB, Inc.

Description

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-29

Generated

2026-10-08

AI Q&A

2026-08-29

EPSS Evaluated

2026-10-07

NVD

CVE-2026-81490

EUVD

EUVD-2026-67931

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	bi_connector	to 2.14.31 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

A database user with privileges to create views in a namespace monitored by MongoDB Connector for BI can cause the schema-sampling routine to fail. This happens when the view's evaluation consistently fails, leading the sampling logic to classify the error as temporary. After retries are exhausted, the routine stops without a valid schema, causing the mongosqld process to run without a usable schema. SQL clients then cannot retrieve results until the view is removed or its namespace is excluded from sampling.

Detection Guidance

Detecting this vulnerability requires checking for failing schema sampling in MongoDB Connector for BI. Monitor mongosqld logs for repeated schema refresh failures or missing schema errors. Verify if a user-created view is causing the sampling routine to fail by querying the database for views in sampled namespaces.

Impact Analysis

This vulnerability can disrupt SQL client operations by preventing them from obtaining query results due to a missing or invalid schema. It may lead to service outages or degraded performance for applications relying on the MongoDB Connector for BI. Operators must manually intervene to remove the problematic view or adjust sampling configurations to restore functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it primarily impacts the functionality of the MongoDB Connector for BI by disrupting schema sampling. However, if SQL clients are unable to obtain results due to the schema refresh failure, it could indirectly impact data access and reporting, potentially affecting compliance reporting timelines or audit trails.

Mitigation Strategies

Remove any problematic views in namespaces sampled by MongoDB Connector for BI or exclude their namespaces from sampling to restore schema refresh functionality.

Hi! I’m here to help you understand CVE-2026-81490. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70