CVE-2026-81520: MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require valid MongoDB credentials or a completed login?
No. A client that has not authenticated can trigger the issue by starting a SASL-based login exchange and not completing it.
Which deployments are exposed to this attack?
Deployments where a network-reachable client can connect to the MongoDB Connector for BI and begin authentication are exposed. The provided information does not state whether any particular default network configuration limits this access.
How can operators recognize the impact, and what restores capacity?
Affected sessions retain a worker, a client connection slot, and associated backend database connections, eventually preventing legitimate users from opening new sessions. These retained resources persist until the Connector for BI process is restarted.