Executive brief
MongoDB Connector for BI is a tool that bridges MongoDB databases to business intelligence platforms. An unauthenticated attacker on the network can indefinitely hold open authentication sessions by starting but never completing the login process, consuming server resources and preventing legitimate users from connecting to the system.
Technical details
This is a denial-of-service vulnerability in MongoDB Connector for BI's SASL authentication handler. An unauthenticated client on the network can initiate a SASL login exchange and then deliberately not complete it, causing the server to hold the connection indefinitely. The root cause is the absence of a timeout on the overall negotiation loop and no read deadline on client communications. Each incomplete session occupies a worker thread, client connection slot, and associated backend database connections. By repeated exploitation, an attacker can exhaust the configured connection pool and prevent legitimate users from establishing sessions. Patches are available in updated release notes documented by MongoDB.
Affected products
- MongoDB Connector for BI
Timeline
- 2026-08-28: published
- 2026-08-28: disclosed