# CVE-2026-6691: MongoDB C Driver heap buffer overflow in Cyrus SASL integration

Source: https://junglewise.ai/threats/cve-2026-6691-mongodb-c-driver-heap-buffer-overflow-in-cyrus-sasl-integration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

CVE-2026-6691 · Severity: high · CVSS 7.8 · Published 2026-05-06

A security vulnerability exists in the MongoDB C Driver, a software component used by applications to communicate with MongoDB databases. An attacker could exploit this flaw by providing a specially crafted connection string, potentially leading to a system crash or unauthorized code execution. This issue occurs during the initial connection phase, even before the user has successfully logged in.

Technologies: [MongoDB C Driver](https://junglewise.ai/threats/technologies/c-driver). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-6691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6691 being exploited in the wild.

**How severe is CVE-2026-6691?** High severity, with a CVSS score of 7.8, published 6 May 2026.

**Which products and versions are affected?** MongoDB C Driver 2.1.0 to 2.1.2.

**Is there a fix for CVE-2026-6691?** A patch was published on 2025-10-24: Issue resolved in development tracking. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6691 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-6691?** Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow vulnerability (CWE-120/CWE-787) exists in the MongoDB C Driver's Cyrus SASL integration. The flaw is rooted in unsafe string copying during the username canonicalization process. An attacker can trigger this overflow by passing a long, untrusted username string within a MongoDB URI when the 'authMechanism' is set to 'GSSAPI'. This occurs locally before authentication or network traffic is initiated. Successful exploitation could lead to arbitrary code execution or a denial-of-service (DoS) condition. The issue is fixed in versions 2.1.3 and 2.2.0.

## Affected products

- MongoDB MongoDB C Driver 2.1.0 to 2.1.2

## Timeline

- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2025-10-24: patched: Issue resolved in development tracking.

## References

- [https://jira.mongodb.org/browse/CDRIVER-6134](https://jira.mongodb.org/browse/CDRIVER-6134)

## Related threats

- [MongoDB C# Driver BSON type allow-list bypass](https://junglewise.ai/threats/cve-2026-126982-a-type-allow-list-bypass-in-the-bson-serialization-library-of)
- [MongoDB C Driver namespace field validation bypass](https://junglewise.ai/threats/cve-2026-120956-the-mongodb-c-driver-does-not-validate-the-type-or-format-of-a)
- [MongoDB C Driver GridFS file download denial of service](https://junglewise.ai/threats/cve-2026-120955-the-gridfs-file-download-api-in-the-mongodb-c-driver-does-not)
- [MongoDB C Driver memory-initialization flaw in GridFS](https://junglewise.ai/threats/cve-2026-120684-a-memory-initialization-flaw-in-the-legacy-gridfs-file-handling)
- [MongoDB C Driver memory leak in compressed responses](https://junglewise.ai/threats/cve-2026-120678-a-memory-management-flaw-in-the-mongodb-c-driver-s-handling-of)