CVE-2026-76797: MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports
The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is required.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs write privileges on the MongoDB cluster so they can create or rename a database or collection namespace containing spreadsheet formula characters. They also need an operator to generate a report covering that namespace and open the CSV in a spreadsheet application.
Is opening the generated CSV required for impact?
Yes. The attacker-controlled namespace is written to the CSV report, but the formula is evaluated only when an operator opens that report in a spreadsheet application.
What is the practical impact on an affected operator?
A spreadsheet application may evaluate the injected formula, potentially disclosing report contents or executing external content on the operator's workstation. The issue does not require direct access to the operator's workstation before the report is opened.