Executive brief
MongoDB's BI Connector Transition Readiness Tool generates HTML reports that document database activity and include user information. The tool fails to properly encode data extracted from log files before inserting it into these reports, allowing attackers to inject malicious code that executes when an operator opens the report in a web browser. This can expose other users' queries and credentials or present misleading information to administrators.
Technical details
The MongoSQL Transition Readiness Tool contains a reflected cross-site scripting (XSS) vulnerability in its HTML report generation mechanism. The vulnerability arises from insufficient output encoding of query text and usernames extracted from BI Connector log files before insertion into generated HTML reports. An attacker with the ability to execute queries through the BI Connector can craft SQL queries containing HTML/JavaScript markup that gets stored in log files. When an operator generates a report containing these logs and opens the resulting HTML file in a browser, the injected markup is rendered and executed with the operator's privileges. This enables disclosure of other users' query history and credentials, or injection of misleading content. Report generation is a required step to trigger this vulnerability; exploitation requires both network access to submit queries and operator interaction (opening the report).
Affected products
- MongoDB BI Connector Transition Readiness Tool <UNKNOWN>
Timeline
- 2026-08-28: disclosed: CVE-2026-76798 published