CVE-2026-77184: MongoDB Connector for BI SQL Injection Flaw

CVE-2026-77184 Overview

CVE-2026-77184 is a SQL injection vulnerability [CWE-89] in the MongoDB Connector for BI. The connector incorporates the description text of a collection's JSON schema validator into the comment text of Data Definition Language (DDL) returned by SHOW CREATE statements. Backslash characters are not fully escaped during this incorporation. A user with permission to modify a collection's schema validator can embed additional SQL text into that generated output. When an operator or automated tool later replays the generated statement against a SQL server, the injected text executes with the privileges of that session.

Critical Impact

Attackers with schema modification rights can inject arbitrary SQL that later executes with session privileges when generated DDL is replayed.

Affected Products

• MongoDB Connector for BI
• Deployments that build SQL schemas from JSON schema validators
• Downstream SQL servers that replay SHOW CREATE DDL output

Discovery Timeline

• 2026-08-28 - CVE-2026-77184 published to NVD
• 2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-77184

Vulnerability Analysis

The MongoDB Connector for BI translates MongoDB collections into a relational schema consumable by SQL clients. When a collection has a JSON schema validator, its description field is copied into the comment portion of the DDL emitted by SHOW CREATE statements. The escaping routine does not fully handle backslash characters. An attacker can craft a description that closes the comment context and appends additional SQL statements.

The injected content becomes indistinguishable from operator-authored SQL once the DDL is captured. Replaying the DDL through migration tooling, schema replication, or manual operator action executes the injected statements against the target SQL server.

Root Cause

The root cause is incomplete input sanitization during string interpolation of the validator description into SQL comment syntax. Backslashes are not neutralized before insertion, allowing the attacker to break out of the comment delimiter sequence and terminate the comment prematurely. Trailing content is then parsed as executable SQL.

Attack Vector

Exploitation requires an authenticated user with permission to modify a collection's schema validator. The attacker sets a crafted description string on the validator. Later, when a legitimate operator or automated pipeline invokes SHOW CREATE and replays the output, the injected SQL executes with that session's privileges. User interaction from the operator or automation is required for the injected SQL to run.

Refer to the MongoDB BI Connector Release Notes for technical details on affected releases.

Detection Methods for CVE-2026-77184

Indicators of Compromise

• JSON schema validator description fields containing backslash sequences, SQL comment delimiters (*/, --), or SQL keywords such as DROP, CREATE, INSERT.
• Unexpected DDL fragments in captured SHOW CREATE output that do not correspond to collection structure.
• SQL server audit logs showing statements executed by migration tooling that do not match authored schema files.

Detection Strategies

• Audit MongoDB collections for validators whose description fields contain characters outside expected human-readable text.
• Diff generated DDL against a known-good baseline before allowing downstream replay.
• Parse SHOW CREATE output through a SQL lexer and alert when the statement count exceeds one.

Monitoring Recommendations

• Log all modifications to collection validators, including the identity of the modifying user and the resulting document.
• Monitor automated schema-replication pipelines for statement volume anomalies during replay operations.
• Correlate SQL server DDL execution events with the source MongoDB validator changes.

How to Mitigate CVE-2026-77184

Immediate Actions Required

• Restrict permission to modify collection schema validators to trusted administrative accounts only.
• Review existing validator description fields and remove any content containing backslashes or SQL syntax.
• Pause automated pipelines that replay SHOW CREATE output until the connector is patched.

Patch Information

Consult the MongoDB BI Connector Release Notes for the fixed release that fully escapes backslash characters in generated DDL comments. Apply the update to all connector instances that build SQL schemas from JSON schema validators.

Workarounds

• Manually review and sanitize DDL output from SHOW CREATE before replaying it against any SQL server.
• Disable the SQL-schema-from-validator feature if it is not required in the deployment.
• Enforce a validator description policy that rejects backslashes and SQL metacharacters at write time.

# Example: audit validator descriptions in a MongoDB shell for suspicious content
mongosh --eval 'db.getCollectionInfos().forEach(c => { const d = c.options && c.options.validator && c.options.validator.$jsonSchema && c.options.validator.$jsonSchema.description; if (d && /[\\]|--|\*\//.test(d)) print(c.name + ": " + d); })'