CVE-2026-76798: MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that report in a browser is required.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to issue queries through the BI Connector so that attacker-controlled query text is written to its log files. Exploitation also depends on an operator later generating an HTML report from logs containing those entries and opening it in a browser.
What user interaction is required for the malicious content to execute?
An operator must generate a report over affected log entries and open the resulting HTML report in a browser. The issue is not triggered merely by logging the attacker-controlled query.
What information could be exposed?
The rendered report may disclose other users' logged query text and user names to an external party. An attacker can also use injected markup to present misleading content to the operator.