CVE-2026-77586: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MongoDB BI Connector

The vulnerability in MongoDB Connector for BI involves improper neutralization of special elements used in SQL commands (CWE-89). Specifically, MongoDB object names such as collection, field, and index names are embedded into quoted identifiers in the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. This allows a user with write permission on a sampled MongoDB collection to create object names that prematurely close the quoted identifier, injecting arbitrary SQL code into the generated output. If an operator or automated tool subsequently executes this generated SQL statement against a SQL server, the injected SQL code runs with the privileges of that session, potentially leading to unauthorized actions.

An attacker with write access to a sampled MongoDB collection can inject arbitrary SQL commands into generated DDL statements. If these statements are executed on a SQL server, the injected commands run with the privileges of that session, potentially leading to unauthorized data access, modification, or other harmful actions. This elevates the risk of data compromise or disruption in environments using the MongoDB BI Connector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid executing generated SQL statements from SHOW CREATE outputs without thorough validation or sanitization. Restrict write permissions on sampled MongoDB collections to trusted users only to reduce risk.