CVE-2026-81517

MongoDB Connector for BI (mongosqld) contains an unhandled-error flaw (CWE-248) in its logging path: an unauthenticated party that can reach the mongosqld port can generate enough routine connection log activity to fill the storage backing the configured log path. When a subsequent log write or log rotation operation fails, the error is not handled and the shared mongosqld process terminates. An attacker gains denial of service: all connected SQL clients lose service, the process keeps dying on every startup until an operator restores available storage, and no diagnostic message is recorded to explain the condition. Any deployment running MongoDB Connector for BI with a network-reachable mongosqld port is exposed, including untrusted internal clients since no authentication is required. Exploitation has not been observed; there is no public proof-of-concept, EPSS is 0.3% (18th percentile), and the issue is not in CISA KEV.

What to do: Apply the fix from MongoDB once a patched Connector for BI release is available (no fixed version was specified in the source data). Until then, restrict network access to the mongosqld port to trusted clients via firewall rules or allowlists, and ensure adequate free storage on the configured log path with monitoring for low-disk conditions. Inventory environments running mongosqld and watch for repeated process termination on startup, which indicates the log-path storage has been exhausted.