CVE-2026-81490

MongoDB Connector for BI (mongosqld) contains an availability flaw in its schema-sampling routine, catalogued as CWE-476 (NULL pointer dereference). A database user with permission to create a view in any namespace the connector samples can define a view whose evaluation reliably fails; the sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, completes the schema refresh without a valid result. The mongosqld process keeps running but without a usable schema, so SQL clients cannot obtain results until an operator removes the view or excludes its namespace from sampling — an availability-only impact scored 8.3 (high) under CVSS 4.0 with no confidentiality or integrity effect. Any deployment in which low-privileged users can create views in sampled namespaces is exposed; the provided data does not specify affected version ranges. No exploitation is known: there is no public proof of concept, it is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days (14th percentile).

What to do: Restrict view-creation (DDL) privileges on namespaces included in Connector for BI sampling and audit existing views in those namespaces; if a schema refresh is already failing, removing the offending view or excluding its namespace from sampling restores SQL query service. Upgrade mongosqld to a fixed release per MongoDB's advisory (fixed versions are not listed in this data), and monitor schema-refresh logs for repeated transient-error retries on sampled namespaces.