CVE-2026-81520
Received
Received - Intake
MongoDB Connector for BI Session Hijacking Vulnerability
Vulnerability report for CVE-2026-81520, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-28
Last updated on: 2026-08-28
Assigner: MongoDB, Inc.
Description
Description
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mongodb | connector_for_bi | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1088 | The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite. |
