CVE-2026-19004: MongoDB BI Connector ODBC Driver RCE Flaw

CVE-2026-19004 Overview

CVE-2026-19004 is a memory-safety vulnerability in the MongoDB BI Connector ODBC Driver. The flaw occurs when an application processes output parameters returned from a stored procedure. Triggering the issue requires a client application to connect to an untrusted or impersonated database server that returns crafted metadata.

Successful exploitation can cause process termination, disclose process memory, or under specific conditions enable arbitrary code execution. The vulnerability is classified as a heap-based buffer overflow [CWE-122]. MongoDB addressed the issue in version v1.4.9 of the BI Connector ODBC Driver.

Critical Impact
Attackers controlling a database endpoint can trigger memory corruption in connecting client applications, potentially leading to remote code execution in the application process.

Affected Products

MongoDB BI Connector ODBC Driver versions prior to v1.4.9
Applications linking against the vulnerable ODBC driver
Business intelligence and reporting tools using the driver to query MongoDB backends

Discovery Timeline

2026-08-12 - CVE-2026-19004 published to NVD
2026-08-12 - Last updated in NVD database
Fix released - MongoDB published BI Connector ODBC Driver v1.4.9 addressing the issue

Technical Details for CVE-2026-19004

Vulnerability Analysis

The MongoDB BI Connector ODBC Driver exposes a SQL interface to MongoDB data, allowing applications to query MongoDB using the Open Database Connectivity (ODBC) protocol. The driver processes metadata returned by the server when handling stored procedure calls that produce output parameters.

A crafted server response can supply malformed metadata for these output parameters. The driver mishandles the metadata during memory allocation or copy operations on the heap, producing a heap-based buffer overflow. Exploitation depends on the client application invoking a stored procedure and processing its output parameters.

Because the attack requires connecting to an attacker-controlled server, exploitation scenarios include hostile database endpoints, DNS or routing hijacks that redirect ODBC traffic, and man-in-the-middle attacks against unauthenticated or improperly validated TLS sessions.

Root Cause

The root cause is improper validation of untrusted server-supplied metadata during output-parameter processing in the ODBC driver. Insufficient bounds checking allows the driver to write beyond an allocated heap buffer, corrupting adjacent memory structures. Depending on the heap layout, corrupted structures may include function pointers or object metadata that influence subsequent control flow.

Attack Vector

An attacker must position a malicious or impersonated MongoDB-facing server that the client will connect to. The client application must then execute a stored procedure that returns output parameters. The server responds with crafted parameter metadata that triggers the memory-safety flaw during response parsing.

User interaction is required in the form of initiating the connection or query. Once triggered, the flaw can crash the application, leak memory contents belonging to the client process, or in specific heap states enable code execution in the context of the calling application.

No verified public exploit code is available. Refer to the MongoDB BI Connector ODBC Driver v1.4.9 release notes for maintainer-provided remediation details.

Detection Methods for CVE-2026-19004

Indicators of Compromise

Unexpected crashes or Dr. Watson/Windows Error Reporting entries for processes loading the MongoDB BI Connector ODBC driver DLL
ODBC client connections to database endpoints that do not match the approved MongoDB inventory
Anomalous outbound connections from BI, reporting, or ETL hosts to unfamiliar IP addresses or hostnames on database ports

Detection Strategies

Inventory endpoints and servers that have the MongoDB BI Connector ODBC Driver installed and identify versions below v1.4.9
Monitor for process crashes or heap corruption events in host telemetry tied to applications using the ODBC driver
Alert on new or previously unseen ODBC connection destinations originating from BI and analytics workstations

Monitoring Recommendations

Enable and forward application crash telemetry and Windows Error Reporting to a central log platform for correlation
Track DNS resolutions for MongoDB and BI Connector hostnames to detect impersonation or redirection
Validate that ODBC connections enforce TLS with certificate verification and log any downgrade or verification failures

How to Mitigate CVE-2026-19004

Immediate Actions Required

Upgrade the MongoDB BI Connector ODBC Driver to version v1.4.9 or later on all client systems
Restrict outbound network access from hosts running the driver so they can only reach approved MongoDB endpoints
Enforce mutual TLS or strict server certificate validation for all ODBC connections to prevent server impersonation

Patch Information

MongoDB released the fixed version as v1.4.9 of the BI Connector ODBC Driver. Download details and release notes are available in the GitHub release for v1.4.9. Apply the update on every workstation, server, and container image that ships the driver.

Workarounds

Avoid invoking stored procedures with output parameters from applications using the vulnerable driver until patched
Route ODBC traffic exclusively through trusted, network-segmented paths that prevent redirection to attacker-controlled servers
Disable or uninstall the BI Connector ODBC driver on hosts that do not require it

bash

# Verify installed driver version on Windows
reg query "HKLM\SOFTWARE\ODBC\ODBCINST.INI\MongoDB ODBC ANSI Driver" /v Driver

# On Linux, check the installed package version
odbcinst -q -d -n "MongoDB ODBC"