CVE-2026-81518

mongosqld, the daemon of MongoDB's Connector for Business Intelligence, mishandles optional client-certificate validation (CWE-295): when configured with a client certificate authority file, it requests a client certificate during the TLS handshake but still accepts clients that present none. An attacker needs only network reachability to the listener; by completing the TLS handshake without a certificate they obtain a session as if they had been authenticated. In deployments that rely on client certificates as the sole means of identifying users, the attacker can then read the MongoDB data exposed through the connector, with confidentiality impact only (CVSS 4.0 shows no integrity or availability impact). Deployments that use the client CA without certificate-only authentication, or that restrict the listener to trusted networks, are not meaningfully exposed. There is currently no public proof-of-concept, the issue is not in CISA KEV, and EPSS is 0.2%, so exploitation is considered unlikely at this time.

What to do: Check the MongoDB security advisory for CVE-2026-81518 for the patched mongosqld version and upgrade. Until patched, do not rely on client certificates as the sole authentication mechanism — layer in another authentication method — and restrict network access to the mongosqld listener with firewall rules. Audit your mongosqld TLS configuration for a client certificate authority file and confirm whether certificates are the only user-identification mechanism in use.