CVE-2026-77586: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MongoDB BI Connector

The vulnerability arises from improper neutralization of special elements used in SQL commands (CWE-89) within the MongoDB Connector for BI. Specifically, collection, field, and index names are embedded into quoted identifiers in SHOW CREATE statement outputs without escaping the delimiter. An attacker with write access to a MongoDB collection can name objects to prematurely close the quoted identifier and append malicious SQL code. This malicious SQL can then be executed if the generated DDL statement is replayed on a SQL server, potentially leading to unauthorized SQL command execution under the session's privileges.

Successful exploitation can lead to execution of arbitrary SQL commands on a SQL server when the generated DDL statements are replayed. This can result in unauthorized data access or modification, depending on the privileges of the SQL session executing the statement. The vulnerability requires the attacker to have write permissions on a sampled MongoDB collection and relies on subsequent replay of the crafted SQL statement against a SQL server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions on MongoDB collections to trusted users only and avoid replaying generated DDL statements from the BI Connector without validation or sanitization.