CVE-2026-19002: MongoDB BI Connector ODBC Driver RCE Flaw

CVE-2026-19002 Overview

CVE-2026-19002 is an out-of-bounds write vulnerability in the MongoDB BI Connector ODBC Driver. The flaw stems from a missing bounds check when the driver parses stored procedure parameter metadata returned by the server. A malicious or attacker-controlled server can return malformed metadata that corrupts memory in the connecting client application process. The resulting memory corruption may terminate the client abnormally or, under specific conditions, lead to arbitrary code execution in the client process. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input).

Critical Impact
An attacker who controls or impersonates a MongoDB server can trigger memory corruption in any client application using the vulnerable BI Connector ODBC Driver, potentially achieving code execution in the client context.

Affected Products

MongoDB BI Connector ODBC Driver versions prior to v1.4.9
Client applications embedding the vulnerable ODBC driver for MongoDB BI connectivity
Analytics and reporting tools that connect to MongoDB via the BI Connector

Discovery Timeline

2026-08-12 - CVE-2026-19002 published to NVD
2026-08-12 - Last updated in NVD database
MongoDB BI Connector ODBC Driver v1.4.9 released with the fix (GitHub Release v1.4.9)

Technical Details for CVE-2026-19002

Vulnerability Analysis

The MongoDB BI Connector ODBC Driver enables SQL-based tools to query MongoDB databases. When a client application calls stored procedure functions through the driver, the driver parses parameter metadata sent by the server. The driver fails to validate the size of this metadata before writing it into a fixed-size buffer. An attacker who controls the server response can craft oversized or malformed parameter metadata that overflows the destination buffer in the client process.

This is a classic client-side deserialization boundary flaw. The trust boundary is inverted: clients typically assume server responses are well-formed, but the driver treats server-supplied metadata as authoritative without validating length fields. Exploitation depends on tricking the client into connecting to a hostile endpoint or intercepting an existing connection.

Root Cause

The driver lacks a length check when copying stored procedure parameter metadata from the server response into a client-side buffer. This is a [CWE-120] classic buffer overflow in which the destination buffer size is not compared against the untrusted input length before the write operation.

Attack Vector

Exploitation requires the attacker to either operate the MongoDB server the client connects to or intercept and respond to the connection in the server's place. Once positioned, the attacker returns malformed parameter metadata in response to a stored procedure query. The oversized metadata overwrites adjacent memory in the client process. Depending on the memory layout and platform mitigations, this may crash the client or divert execution flow. User interaction is required because a client must initiate the query that triggers metadata parsing.

No public proof-of-concept exploit is available. Technical details of the fix are published in the MongoDB BI Connector ODBC Driver v1.4.9 release notes.

Detection Methods for CVE-2026-19002

Indicators of Compromise

Unexpected crashes or abnormal termination of applications using the MongoDB BI Connector ODBC Driver
Client processes connecting to MongoDB endpoints outside of approved server inventories
ODBC driver DLLs at pre-v1.4.9 versions loaded by analytics or reporting tools
Anomalous outbound TCP connections from BI or reporting workstations to untrusted hosts on MongoDB or proxy ports

Detection Strategies

Inventory endpoints for installed versions of the MongoDB BI Connector ODBC Driver and flag any below v1.4.9
Monitor process crash telemetry from BI tools such as Tableau, Power BI, and Excel that use ODBC data sources
Alert on ODBC client processes establishing connections to MongoDB servers not on an approved allowlist
Correlate driver load events with subsequent process exceptions to identify exploitation attempts

Monitoring Recommendations

Log all outbound connections initiated by processes loading the BI Connector ODBC driver module
Enable Windows Error Reporting or equivalent crash telemetry collection on hosts running BI tooling
Track DNS resolutions for MongoDB hostnames from client workstations to detect redirection to attacker-controlled hosts
Baseline normal driver behavior and alert on deviations in connection destinations or query patterns

How to Mitigate CVE-2026-19002

Immediate Actions Required

Upgrade the MongoDB BI Connector ODBC Driver to v1.4.9 or later on all client workstations and servers
Restrict outbound network access from BI client hosts to only trusted, approved MongoDB endpoints
Enforce TLS with certificate validation on all MongoDB BI Connector connections to prevent server impersonation
Audit and remove unused ODBC data source name (DSN) entries pointing to untrusted hosts

Patch Information

MongoDB released the fix in the BI Connector ODBC Driver v1.4.9. See the GitHub Release v1.4.9 for downloads and release notes. Administrators should replace the driver on every system that connects to MongoDB through ODBC and confirm that BI applications load the updated binary.

Workarounds

Disable or uninstall the BI Connector ODBC Driver on hosts that do not require MongoDB analytics connectivity
Route all BI Connector traffic through authenticated VPNs or private network segments to limit exposure to man-in-the-middle attacks
Configure host-based firewalls to permit only outbound connections from BI clients to known MongoDB server IP addresses
Require mutual TLS authentication between clients and MongoDB servers to prevent unauthorized servers from responding

bash

# Verify installed BI Connector ODBC Driver version on Windows
reg query "HKLM\SOFTWARE\ODBC\ODBCINST.INI\MongoDB ODBC 1.4 Unicode Driver" /v DriverODBCVer

# Restrict outbound MongoDB connections to approved hosts (Linux example)
iptables -A OUTPUT -p tcp --dport 3307 -d <approved_mongodb_host> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 3307 -j DROP