CVE-2026-81518
Description
A flaw was found in mongosqld. When mongosqld is configured to use client certificates for authentication, it requests a certificate during the TLS (Transport Layer Security) handshake but does not enforce its presence. This allows a remote attacker with network access to establish a session without presenting a client certificate. Consequently, the attacker can read MongoDB data exposed through the connector, leading to information disclosure.
Statement
An authentication bypass flaw was found in mongosqld, the MongoDB BI Connector SQL daemon. When mongosqld is configured to use client certificates as the sole means of authenticating users, it requests a client certificate during the TLS handshake but does not enforce its presence. A remote attacker with network access to the listener can exploit this flaw by connecting without presenting a client certificate, bypassing authentication controls. This allows unauthorized access to read MongoDB data exposed through the connector. The vulnerability only affects deployments that rely exclusively on client certificate authentication for user identification.
Mitigation
Update to a patched version of MongoDB BI Connector. In the interim, implement defense-in-depth by not relying solely on client certificate authentication — use additional authentication mechanisms such as username/password authentication or IP-based access controls to protect mongosqld listeners.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
