Description
A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.
Published: 2026-08-28
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A database user with the ability to create a view can define a view that reliably fails during the BI Connector’s schema‐sampling routine. The Connector interprets the resulting error as transient, exhausts its retry attempts, and abandons the schema refresh, leaving the internal schema state invalid. When this occurs the mongosqld process continues running but cannot provide correct query results, effectively denying service to SQL clients until the offending view is removed or the namespace excluded from sampling.

Affected Systems

Any installation of MongoDB Connector for BI that includes the schema‐sampling functionality is affected. The issue is present regardless of specific Connector version, provided the sampling routine remains active and view‑creation permissions are not tightly controlled.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a privileged database account that can create views within a namespace sampled by the Connector, a privilege often assigned to trusted users. In environments where such permissions are broadly granted, the threat is likely exploitable, enabling attackers to cause prolonged denial of service for connected SQL clients.

Generated by OpenCVE AI on August 29, 2026 at 00:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict view‑creation privileges to trusted users or roles that do not affect the sampled namespaces.
  • Exclude any namespaces containing potentially problematic views from the Connector’s schema‑sampling configuration.
  • Monitor Connector logs for schema‑sampling failures and rebuild the schema or remove offending views when failures are detected.

Generated by OpenCVE AI on August 29, 2026 at 00:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb bi Connector
Vendors & Products Mongodb
Mongodb bi Connector

Fri, 28 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.
Title MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H'}


Subscriptions

Mongodb Bi Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-08-28T20:10:38.565Z

Reserved: 2026-08-26T20:48:19.853Z

Link: CVE-2026-81490

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T22:16:54.247

Modified: 2026-08-28T22:16:54.247

Link: CVE-2026-81490

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T00:30:17Z

Weaknesses