MongoDB BI Connector Vulnerability Affecting Unauthenticated Network Clients

CVE-2026-81520

What is CVE-2026-81520?

A vulnerability exists in the MongoDB Connector for BI where a network-reachable, unauthenticated client can initiate a SASL-based login process and subsequently refuse to complete it. This flaw allows the session to remain open indefinitely, as there is no overall time limit for the negotiation loop, nor a deadline for reading from the client. Such sessions continue to consume resources by maintaining a worker thread, a client connection slot, and associated backend database connections, leading to potential exhaustion of available connections. This situation can hinder legitimate users from establishing new sessions, thereby impacting overall server performance and availability.

References