# CVE-2026-77184: MongoDB Connector for BI SQL injection in JSON schema validator comments

Source: https://junglewise.ai/threats/cve-2026-77184-mongodb-connector-for-bi-sql-injection-in-json-schema-validator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77184 · Severity: medium · CVSS 5.2 · Published 2026-08-28

MongoDB Connector for BI is a tool that translates MongoDB queries into SQL for compatibility with SQL databases. The connector fails to properly escape special characters when converting JSON schema validator descriptions into SQL comments, allowing a user with schema modification permissions to inject malicious SQL code. If an operator or tool replays the generated SQL statements against a SQL server, the injected SQL executes with full session privileges, potentially compromising the SQL database.

Technologies: [MongoDB Connector for BI](https://junglewise.ai/threats/technologies/connector-for-bi). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-77184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77184 being exploited in the wild.

**How severe is CVE-2026-77184?** Medium severity, with a CVSS score of 5.2, published 28 August 2026.

**Which products and versions are affected?** MongoDB Connector for BI <UNKNOWN>.

**Is there a fix for CVE-2026-77184?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77184 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77184?** Check whether you run MongoDB Connector for BI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection issue in the MongoDB Connector for BI's DDL generation logic. When a collection's JSON schema validator description is incorporated into SHOW CREATE statement output, backslash characters are not completely escaped in the resulting SQL comment text. An attacker with permission to modify a collection's schema validator can craft a malicious description containing SQL syntax that breaks out of the comment context when the DDL is replayed. The attack requires both schema modification privileges and a subsequent action (manual or automated replay of the DDL) against a SQL server. The injected SQL executes in the context of the replaying session's privileges.

## Affected products

- MongoDB Connector for BI <UNKNOWN>

## Timeline

- 2026-08-28: disclosed

## References

- [https://www.mongodb.com/docs/bi-connector/current/release-notes/](https://www.mongodb.com/docs/bi-connector/current/release-notes/)

## Related threats

- [MongoDB Connector for BI denial of service via incomplete SASL authentication](https://junglewise.ai/threats/cve-2026-81520-mongodb-connector-for-bi-denial-of-service-via-incomplete-sasl)
- [MongoDB Connector for BI client certificate validation bypass](https://junglewise.ai/threats/cve-2026-81518-mongodb-connector-for-bi-client-certificate-validation-bypass)
- [MongoDB Connector for BI denial of service via log exhaustion](https://junglewise.ai/threats/cve-2026-81517-mongodb-connector-for-bi-denial-of-service-via-log-exhaustion)
- [MongoDB Connector for BI schema-sampling denial of service](https://junglewise.ai/threats/cve-2026-81490-mongodb-connector-for-bi-schema-sampling-denial-of-service)
- [MongoDB Connector for BI SQL injection via unescaped identifiers](https://junglewise.ai/threats/cve-2026-77586-mongodb-connector-for-bi-sql-injection-via-unescaped-identifiers)