CVE-2026-81520

MongoDB Connector for BI (mongosqld) fails to bound its authentication negotiation: an unauthenticated, network-reachable client can begin a SASL-based login exchange and then decline to complete it, and because the negotiation loop has no overall time limit and reads from the client have no deadline, the session hangs indefinitely. Each stalled session keeps a worker, a client connection slot, and its associated backend database connections occupied until the process is restarted. By repeating this, an attacker consumes the configured connection capacity and prevents legitimate users from establishing new sessions, i.e., a denial of service with no confidentiality or integrity impact (CVSS 4.0 scores high availability impact only). Affected are organizations running the MongoDB Connector for BI to expose MongoDB data to SQL-based BI and analytics clients where the connector's listening port is reachable from an untrusted network. No exploitation is currently known: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade the MongoDB Connector for BI to the patched release identified in MongoDB's advisory (exact fixed version numbers were not included in the available data). Until patching, restrict network access to the BI Connector's port to trusted BI client addresses, monitor active connection counts for sessions stuck in authentication, and restart the mongosqld process to release any pinned connections.