Executive brief
MongoDB Connector for BI (mongosqld) is a tool that allows SQL clients to query MongoDB databases. An unauthenticated attacker can exhaust disk storage by repeatedly connecting to the service, causing excessive log writes. When disk space runs out, the service crashes and will not restart until storage is manually restored, resulting in a complete outage for all SQL clients.
Technical details
The vulnerability is a denial-of-service flaw in the logging mechanism of MongoDB Connector for BI. An unauthenticated remote attacker can trigger repeated connection attempts to the mongosqld port, generating large volumes of routine connection logs. When the configured log path runs out of storage space, log write and rotation operations fail without proper error handling, causing the mongosqld process to terminate. The process will continuously fail on restart until an operator manually frees disk space. The root cause is inadequate error handling for log storage exhaustion, combined with a lack of diagnostic logging to explain the condition.
Affected products
- MongoDB Connector for BI
Timeline
- 2026-08-28: disclosed