CVE-2026-6691: MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not use 'authMechanism=GSSAPI' in MongoDB connection URIs that include untrusted or user-supplied usernames; remove or change the authMechanism in the URI or ensure the username is trusted before including it.
MongoDB C Driver (Cyrus SASL integration) authMechanism = do not set to GSSAPI when username contains untrusted input - Compensating control
Validate or sanitize any external input before placing it in the username field of a MongoDB URI. Reject or canonicalize untrusted usernames prior to constructing connection strings when authMechanism=GSSAPI is used.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6691?
The severity of CVE-2026-6691 is classified as critical due to the potential for remote code execution via a heap buffer overflow.
How do I fix CVE-2026-6691?
To fix CVE-2026-6691, update the MongoDB C Driver to the latest patched version provided by MongoDB.
What are the potential risks of CVE-2026-6691?
Exploitation of CVE-2026-6691 could allow unauthorized access or malicious commands to be executed on the affected system.
Who is affected by CVE-2026-6691?
CVE-2026-6691 affects all installations using the MongoDB C Driver that integrate with Cyrus SASL.
Is there a workaround for CVE-2026-6691?
There are no known effective workarounds for CVE-2026-6691, and users are advised to apply the recommended updates.