CVE-2026-81533 is a medium severity stack-based buffer overflow vulnerability in the MongoDB BI Connector ODBC Driver. It occurs when a SQL statement includes a LIMIT clause followed by an unusually long sequence of digits, and the driver's optional prefetch setting is enabled. The vulnerability arises because the driver copies this digit sequence into a fixed-size buffer without validating its length. This can lead to application process termination or memory corruption if a user can control the numeric portion of the LIMIT clause.
CVE-2026-81532 is a high-severity stack-based buffer overflow vulnerability in the MongoDB BI Connector ODBC driver. It occurs when a user submits a positioned-cursor SQL statement with a cursor name longer than an internal fixed-length buffer. This causes memory adjacent to the buffer to be overwritten, potentially terminating the hosting application or allowing unintended code execution.
CVE-2026-81520 is a vulnerability in the MongoDB BI Connector where an unauthenticated network client can indefinitely hold an authentication session open by starting but not completing a SASL login exchange. This lack of timeout or read deadline allows the session to retain resources such as a worker, client connection slot, and backend database connections until the process is restarted. Repeated exploitation can exhaust connection capacity, blocking legitimate users from establishing new sessions.
CVE-2026-81518 is a high-severity vulnerability in the MongoDB BI Connector where improper certificate validation occurs. Specifically, when mongosqld is configured with a client certificate authority file, it requests but does not require a client certificate during the TLS handshake. This allows clients without certificates to connect. In environments relying solely on client certificates for user identification, this flaw enables unauthorized remote parties with network access to read MongoDB data exposed through the connector.
CVE-2026-81517 is a high-severity vulnerability in the MongoDB BI Connector (mongosqld) where an unauthenticated attacker can cause the service to terminate by exhausting the storage used for logging. When the log storage is full, subsequent log write or rotation failures trigger an unhandled exception that crashes the mongosqld process, disrupting service for all connected SQL clients. The process continues to fail on startup until storage is restored, and no diagnostic message is recorded to explain the failure.
CVE-2026-81490 is a high-severity vulnerability in the MongoDB BI Connector where a database user can create a specially crafted view that causes the schema-sampling routine to fail. This failure leads to the mongosqld process running without a usable schema, preventing SQL clients from obtaining query results until the problematic view is removed or excluded from sampling.
CVE-2026-77586 is a high-severity SQL injection vulnerability in the MongoDB Connector for BI version 2.1.0. It occurs because MongoDB object names are inserted into quoted identifiers in DDL statements without properly escaping the identifier delimiter. This allows a user with write permissions on a sampled MongoDB collection to craft object names that inject additional SQL commands. If these generated statements are replayed against a SQL server, the injected SQL executes with the privileges of that session.
CVE-2026-77184 is a medium severity SQL injection vulnerability in MongoDB Connector for BI version 2.1.0. It arises because the description text of a collection's JSON schema validator is included in the comment text of DDL statements generated by SHOW CREATE without properly escaping backslash characters. A user with permission to modify the schema validator can embed additional SQL code in this output. If this generated SQL statement is later executed against a SQL server, the injected SQL runs with the privileges of that session.
CVE-2026-76798 is a cross-site scripting (XSS) vulnerability in the MongoDB BI Connector Transition Readiness Report version 1.0.0. The issue arises because the tool writes query text and user names from BI Connector log files into an HTML report without proper encoding. This allows a user who can issue queries through the BI Connector to inject markup that is interpreted by the browser when the report is generated and viewed. Exploitation requires generating and opening a report containing the malicious log entries.
CVE-2026-76797 is a medium severity vulnerability in the MongoDB BI Connector Transition Readiness Report tool. The tool writes database and collection names into CSV reports without neutralizing leading characters that spreadsheet applications interpret as formulas. A user with write privileges can create namespace names that cause spreadsheet applications to evaluate these as formulas when the report is opened, potentially leading to unintended disclosure or execution of external content. Exploitation requires generating a report for the affected namespace and opening it in a spreadsheet application.
CVE-2026-76794 is a medium severity cross-site scripting (XSS) vulnerability in the MongoDB BI Connector Transition Readiness Report. The issue arises because the MongoSQL Transition Readiness Tool does not properly encode database metadata before including it in generated HTML reports. A MongoDB user with write access can inject crafted metadata that may execute script code when another user generates and views the report, potentially exposing report contents or altering the report's display.
CVE-2026-81524 is a medium severity vulnerability in the MongoDB C Driver where improper sanitization of database and collection name components allows operations to be directed at unintended resources. This occurs when untrusted input is incorporated into these name components, leading to potential resource injection.
CVE-2026-81525 is a high-severity vulnerability in the MongoDB PHP client library involving improper neutralization of special elements in namespace identifiers. This flaw can cause database operations to be redirected to unintended storage locations when untrusted input is used. It affects multiple versions of the library, including versions before 1.21.4 and 2.4.1. No official patch or remediation guidance is currently available.
CVE-2026-81523 is a low-severity vulnerability in MongoDB's libmongocrypt library version 1.0.0 through before 1.20.3. It involves improper neutralization of special elements in output used by a downstream component, specifically due to missing input validation in the automatic-encryption context setup. This allows a caller-supplied database identifier to be accepted without sanitization, potentially leading to incorrect schema selection and limited disclosure or modification of application-handled information.
CVE-2026-81521 is a high-severity vulnerability in the MongoDB Go Driver affecting the Client.BulkWrite API. It arises from improper control of resource identifiers, where a caller-supplied database name containing a reserved separator character is not escaped before use. This flaw allows an application passing untrusted input as a database name to have writes directed to unintended databases and collections.
CVE-2026-81530 is a vulnerability in the MongoDB C# Driver version 2.10.0 where sensitive key-management credentials are logged in plaintext in diagnostic outputs. This occurs because the driver fails to mask these credentials in its human-readable client settings representation. An attacker with access to application logs, diagnostic output, or process memory dumps could recover these plaintext credentials and potentially decrypt protected field data.
CVE-2026-81529 is a high-severity vulnerability in the MongoDB C# Driver involving improper neutralization of delimiters in connection-URL construction. This flaw allows a low-privileged user to inject or suppress security-relevant connection options by passing untrusted text that is not properly sanitized. The vulnerability affects specific versions of the driver and could lead to unauthorized modification of connection settings.