CVE-2026-81520

Awaiting Analysis Awaiting Analysis - Queue

MongoDB Connector for BI Session Hijacking Vulnerability

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: MongoDB, Inc.

Description

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81520

EUVD

EUVD-2026-67939

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	connector_for_bi	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1088	The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated network client to indefinitely hold open a MongoDB Connector for BI authentication session by starting a SASL login but not completing it. The session consumes worker threads, connection slots, and database connections without any time limit, leading to resource exhaustion.

Detection Guidance

Monitor for long-running unauthenticated SASL login sessions in MongoDB Connector for BI. Check for connections holding worker threads and backend database connections without completing authentication. Use netstat or ss to list active connections and identify suspicious sessions.

Impact Analysis

This vulnerability can cause denial of service by exhausting available connections, preventing legitimate users from accessing the system. It may lead to degraded performance or complete unavailability of the MongoDB Connector for BI service.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR and HIPAA by enabling denial-of-service conditions that disrupt availability of MongoDB Connector for BI services. Unauthenticated sessions consuming connection resources may prevent legitimate users from accessing systems, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.312(a)(1)).

Mitigation Strategies

Restart the MongoDB Connector for BI service to clear malicious sessions. Update to the latest patched version if available. Implement connection timeouts and enforce authentication completion deadlines to prevent indefinite session holding.

Hi! I’m here to help you understand CVE-2026-81520. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70