CVE-2026-81490: MongoDB Connector for BI DOS Vulnerability

CVE-2026-81490 Overview

CVE-2026-81490 is a denial of service vulnerability in the MongoDB Connector for Business Intelligence (BI). A database user with permission to create a view in a namespace sampled by the connector can define a view whose evaluation reliably fails. The schema-sampling routine misclassifies the resulting server error as transient, exhausts its retries, and then terminates the schema refresh without a valid result. The mongosqld process continues running but holds no usable schema, blocking SQL clients from returning results until an operator intervenes.

Critical Impact
An authenticated low-privileged user can persistently disable SQL query capabilities in mongosqld by creating a single malformed view, requiring operator action to restore service.

Affected Products

MongoDB Connector for BI (mongosqld)
Deployments exposing sampled namespaces to users with view-creation privileges
SQL client integrations relying on BI Connector schema translation

Discovery Timeline

2026-08-28 - CVE-2026-81490 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-81490

Vulnerability Analysis

The MongoDB Connector for BI translates MongoDB collections into a relational schema so that SQL clients can query document data. To build this schema, mongosqld periodically samples documents from each namespace in scope, including views. The sampling logic wraps operations in a retry loop that treats certain server responses as transient failures worthy of another attempt.

The defect lies in how the retry classifier interprets failures produced during view evaluation. When a view definition is crafted so that evaluation always fails, the server returns an error the sampler labels transient. After the retry budget is exhausted, the routine exits without a valid schema rather than isolating the failing namespace and continuing. The connector process remains alive, yet SQL clients receive no results because no usable schema has been published.

This behavior maps to [CWE-476] handling patterns where a missing or null result is propagated instead of triggering a hard failure or a targeted skip. Recovery requires operator action: removing the offending view or excluding its namespace from sampling.

Root Cause

The schema-refresh routine does not distinguish between recoverable transport errors and deterministic view-evaluation errors. All failures are funneled through the same retry-then-abandon path, so a single poisoned view halts the entire schema build.

Attack Vector

The attack requires network access to MongoDB with credentials permitting view creation in a sampled namespace. The attacker issues a db.createView() operation defining a view whose pipeline reliably throws an error during evaluation. On the next sampling cycle, mongosqld fails to produce a schema and downstream SQL clients lose the ability to query data through the connector.

The vulnerability is described in prose only; no verified exploit code is available. Refer to the MongoDB BI Connector Release Notes for vendor guidance on affected builds and fixes.

Detection Methods for CVE-2026-81490

Indicators of Compromise

Repeated schema-sampling failure messages in mongosqld logs referencing view evaluation errors
SQL clients receiving empty result sets or schema-not-available errors while mongosqld remains running
Creation of new views in sampled namespaces immediately preceding schema refresh failures

Detection Strategies

Alert on mongosqld log entries indicating retry exhaustion during schema sampling
Correlate MongoDB audit log createView events with subsequent BI Connector schema refresh errors
Track BI Connector schema-refresh success rate and alert when consecutive refreshes fail

Monitoring Recommendations

Enable MongoDB audit logging for createView, collMod, and related DDL operations on sampled databases
Ship mongosqld process logs to a centralized log platform and build detections for retry-exhaustion messages
Monitor SQL client error rates and query latency against BI Connector endpoints as a service-health signal

How to Mitigate CVE-2026-81490

Immediate Actions Required

Identify and drop any recently created views in sampled namespaces that fail on evaluation
Restrict view-creation privileges on databases sampled by the BI Connector to trusted administrators only
Restart mongosqld after remediating the offending view to force a clean schema refresh

Patch Information

MongoDB tracks fixes for BI Connector defects in the MongoDB BI Connector Release Notes. Operators should upgrade mongosqld to the release that addresses CVE-2026-81490 and validate schema sampling behavior after deployment.

Workarounds

Exclude the affected namespace from sampling using the mongosqld schema configuration until the view is removed or the connector is patched
Precompute a static schema with mongodrdl and run mongosqld in a mode that consumes that fixed schema, bypassing runtime sampling
Apply role-based access control to remove createCollection and view-creation rights from application users on sampled databases

bash

# Configuration example: revoke view-creation on the sampled database
use admin
db.revokeRolesFromUser("bi_app_user", [ { role: "readWrite", db: "analytics" } ])
db.grantRolesToUser("bi_app_user", [ { role: "read", db: "analytics" } ])

# Exclude a specific namespace from BI Connector sampling
# mongosqld --schemaSource analytics --excludeNamespace 'analytics.suspect_view'