Executive brief
MongoDB Connector for BI is a tool that allows SQL clients to query MongoDB databases. An attacker with database user privileges can create a malicious view that causes the schema-sampling process to fail repeatedly, preventing the connector from building a usable schema. As a result, SQL clients lose the ability to execute queries until an administrator manually removes the problematic view or reconfigures the system.
Technical details
The vulnerability exists in the schema-sampling routine of mongosqld, which attempts to introspect MongoDB collections to build a queryable schema. An authenticated database user can create a view with an expression that reliably fails evaluation. The sampling logic misclassifies this failure as a transient error and exhausts its retry mechanism, eventually proceeding without valid schema data. The mongosqld process continues running but with a corrupted or missing schema, rendering SQL queries impossible. The attack requires database write permissions to create views, and the only recovery is manual intervention to remove the view or exclude its namespace from sampling.
Affected products
- MongoDB Connector for BI
Timeline
- 2026-08-28: disclosed