CVE-2026-81518: BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When configuring mongosqld with a client certificate authority file, ensure the listener requires a client certificate during the TLS handshake so that clients presenting no certificate are rejected.
MongoDB BI Connector (mongosqld listener TLS) Client certificate requirement (TLS mutual authentication) = Require client certificates
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
Prioritize mongosqld listeners configured with a client certificate authority file where client certificates are the only mechanism used to identify users. The issue is reachable by remote parties that have network access to the listener.
Does an attacker need valid client credentials to connect?
No. Although the listener requests a client certificate during the TLS handshake, it accepts clients that present no certificate.
What could an unauthenticated connection expose?
A remote party may establish a session and read MongoDB data exposed through the BI Connector. The described impact is confidentiality loss; integrity and availability impacts are not identified.