CVE-2026-77586: MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output
In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can choose a name that closes the quoted identifier early, so that additional SQL text becomes part of the generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs permission to write to a sampled MongoDB collection and must be able to create an object name containing the identifier delimiter. A user or automated process must then replay affected SHOW CREATE output against a SQL server.
Whose privileges are used when injected SQL runs?
The additional SQL executes with the privileges of the SQL server session that replays the generated statement. The impact therefore depends on the permissions assigned to the operator or automated tool performing that replay.
Which MongoDB object names can carry the injected SQL?
The affected generated DDL can include unescaped collection, field, and index names. Any of these names may close a quoted identifier early and add SQL text to the output.