MongoDB BI Connector Client Certificate Bypass Vulnerability

CVE-2026-81518

What is CVE-2026-81518?

The MongoDB BI Connector has a vulnerability where, during the TLS handshake process, the listener requests a client certificate but does not enforce its necessity. As a result, a remote attacker with network access can connect to the listener without providing a valid client certificate. This flaw circumvents intended access controls, making it possible for unauthorized users to establish a session and access sensitive MongoDB data.

References