CVE-2026-77586

MongoDB Connector for BI fails to escape identifier delimiters when it inserts MongoDB collection, field, and index names into the quoted identifiers of the DDL text returned by SHOW CREATE statements (CWE-89). A user who has permission to write to a sampled MongoDB collection can craft an object name that closes the quoted identifier early, injecting additional SQL text into the generated statement. If an operator or automated tool later replays that generated statement against a SQL server, the injected text executes with the privileges of that session, giving the attacker SQL execution (rated high for confidentiality, integrity, and availability on the affected system). Affected are deployments of MongoDB Connector for BI in which low-privileged users can write to collections being sampled; the available data does not specify vulnerable version ranges. Exploitation is not currently known to occur in the wild, with no public proof-of-concept, a 0.2% 30-day EPSS probability, and no entry in CISA's KEV catalog.

What to do: Check MongoDB's advisory for this CVE and upgrade Connector for BI to the patched version once identified. In the meantime, restrict write permissions on collections that are being sampled, and avoid replaying SHOW CREATE output against SQL servers without reviewing object names for embedded identifier delimiters (quotes/backticks).