CVE-2026-81517: MongoDB Connector for BI DOS Vulnerability

CVE-2026-81517 Overview

CVE-2026-81517 is a denial-of-service vulnerability in the MongoDB Connector for Business Intelligence (mongosqld). An unauthenticated attacker who can reach the connector's network port can generate routine connection activity that fills the storage backing the configured log path. Once a log write or log rotation fails, mongosqld does not handle the resulting error and the shared process terminates. Service ends for all connected SQL clients, and the process continues to exit on startup until an operator frees storage. The diagnostic message explaining the condition is not recorded, complicating triage. The weakness is classified as [CWE-248] Uncaught Exception.

Critical Impact
Unauthenticated attackers on the network can crash the shared mongosqld service and prevent restart, disrupting all SQL clients that depend on the BI Connector.

Affected Products

MongoDB Connector for BI (mongosqld)
Deployments exposing the mongosqld port to untrusted networks
Environments where SQL clients rely on mongosqld for MongoDB access

Discovery Timeline

2026-08-28 - CVE-2026-81517 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-81517

Vulnerability Analysis

The MongoDB Connector for BI provides a SQL interface to MongoDB deployments through the mongosqld daemon. Each incoming connection produces routine log entries at the configured log path. A remote party that can reach the listener does not need credentials to trigger these writes. Repeated connections generate sustained log growth until the underlying filesystem or volume reaches capacity.

When the log subsystem next attempts a write or rotation and the storage is full, the operation fails. The daemon does not catch this failure. The exception propagates and terminates the shared mongosqld process, disconnecting every SQL client at once. On subsequent starts the same log write is attempted, fails, and the process exits again. The service remains unavailable until an operator manually restores free space on the log volume.

Root Cause

The root cause is an uncaught exception [CWE-248] in the log write and rotation path. mongosqld treats log I/O as always available and does not degrade gracefully when the backing storage is exhausted. A secondary defect is that the diagnostic message describing the terminal condition is not written, so operators lack an in-process record explaining the crash loop.

Attack Vector

The attack requires only network reachability to the mongosqld listening port. No authentication, user interaction, or specialized tooling is required. An attacker opens repeated connections at a rate sufficient to fill the log volume. The exploit succeeds when a subsequent log operation encounters an out-of-space condition and the process aborts. The impact is limited to availability; confidentiality and integrity are not affected. See the MongoDB BI Connector Release Notes for vendor guidance.

Detection Methods for CVE-2026-81517

Indicators of Compromise

Rapid growth of mongosqld log files preceding an unexpected process exit.
Filesystem or volume backing the log path reporting 100% utilization.
mongosqld failing to start with no diagnostic entry recorded in the log destination.
Large volume of short-lived, unauthenticated TCP connections to the mongosqld listener from unexpected sources.

Detection Strategies

Monitor log volume free space and file growth rate on hosts running mongosqld.
Alert on mongosqld process termination events and start-crash loops via service supervisor telemetry.
Correlate connection counts against the BI Connector port with disk-space alerts to identify abuse patterns.

Monitoring Recommendations

Track connection source addresses to the mongosqld port and baseline expected clients.
Emit filesystem capacity metrics and disk pressure events to the SIEM for the log volume.
Watch for repeated exit-code events from the service manager (systemd, supervisord) that indicate a restart loop.

How to Mitigate CVE-2026-81517

Immediate Actions Required

Restrict network access to the mongosqld port using firewall rules or security groups so only authorized SQL clients can connect.
Place mongosqld behind a private network segment or VPN rather than exposing it to untrusted networks.
Provision a dedicated log volume with sized capacity and configure aggressive log rotation and retention limits.
Apply the latest MongoDB Connector for BI release once the fix is available; monitor the vendor release notes.

Patch Information

Refer to the MongoDB BI Connector Release Notes for the fixed version and upgrade instructions. Track NVD updates for CVE-2026-81517 for changes to affected version ranges.

Workarounds

Isolate mongosqld on a management network and enforce allow-lists at the network layer.
Configure logRotate and set a bounded log directory size with external log shipping to a separate volume.
Use filesystem quotas on the log path to prevent a single log file from consuming all available storage.
Add health checks that alert when the log volume exceeds a defined utilization threshold before exhaustion occurs.

bash

# Example: restrict mongosqld exposure and cap log volume utilization
# 1. Firewall the mongosqld listener (default 3307) to trusted clients only
sudo iptables -A INPUT -p tcp --dport 3307 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3307 -j DROP

# 2. Mount a dedicated, size-limited volume for the log path
#    (example: /var/log/mongosqld on its own filesystem)
# 3. Configure log rotation with retention limits
cat >/etc/logrotate.d/mongosqld <<'EOF'
/var/log/mongosqld/*.log {
    hourly
    rotate 24
    size 100M
    compress
    missingok
    notifempty
    copytruncate
}
EOF