# CVE-2026-76798: MongoDB BI Connector Transition Readiness Tool cross-site scripting in HTML report generation

Source: https://junglewise.ai/threats/cve-2026-76798-mongodb-bi-connector-transition-readiness-tool-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76798 · Severity: medium · CVSS 6.3 · Published 2026-08-28

MongoDB's BI Connector Transition Readiness Tool generates HTML reports that document database activity and include user information. The tool fails to properly encode data extracted from log files before inserting it into these reports, allowing attackers to inject malicious code that executes when an operator opens the report in a web browser. This can expose other users' queries and credentials or present misleading information to administrators.

Technologies: [MongoDB Mongosql Transition Readiness Tool](https://junglewise.ai/threats/technologies/mongosql-transition-readiness-tool). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-76798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76798 being exploited in the wild.

**How severe is CVE-2026-76798?** Medium severity, with a CVSS score of 6.3, published 28 August 2026.

**Which products and versions are affected?** MongoDB BI Connector Transition Readiness Tool <UNKNOWN>.

**Is there a fix for CVE-2026-76798?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76798 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76798?** Check whether you run MongoDB BI Connector Transition Readiness Tool or MongoDB Mongosql Transition Readiness Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MongoSQL Transition Readiness Tool contains a reflected cross-site scripting (XSS) vulnerability in its HTML report generation mechanism. The vulnerability arises from insufficient output encoding of query text and usernames extracted from BI Connector log files before insertion into generated HTML reports. An attacker with the ability to execute queries through the BI Connector can craft SQL queries containing HTML/JavaScript markup that gets stored in log files. When an operator generates a report containing these logs and opens the resulting HTML file in a browser, the injected markup is rendered and executed with the operator's privileges. This enables disclosure of other users' query history and credentials, or injection of misleading content. Report generation is a required step to trigger this vulnerability; exploitation requires both network access to submit queries and operator interaction (opening the report).

## Affected products

- MongoDB BI Connector Transition Readiness Tool <UNKNOWN>

## Timeline

- 2026-08-28: disclosed: CVE-2026-76798 published

## References

- [https://www.mongodb.com/docs/sql-interface/changelog/](https://www.mongodb.com/docs/sql-interface/changelog/)

## Related threats

- [MongoDB MongoSQL Transition Readiness Tool CSV formula injection](https://junglewise.ai/threats/cve-2026-76797-mongodb-mongosql-transition-readiness-tool-csv-formula-injection)
- [MongoDB MongoSQL Transition Readiness Tool XSS in HTML report generation](https://junglewise.ai/threats/cve-2026-76794-mongodb-mongosql-transition-readiness-tool-xss-in-html-report)