MongoDB Connector for BI: Indefinite SASL Session Abuse Enables DoS
CVE-2026-81520 Published on August 28, 2026
MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.
Vulnerability Analysis
CVE-2026-81520 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Synchronous Access of Remote Resource without Timeout
The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.
Affected Versions
MongoDB BI Connector:- Before 2.14.31 is affected.