Description
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.
Published: 2026-08-28
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

mongosqld requests but does not enforce a client certificate during TLS handshakes when a CA file is configured, resulting in a Client Certificate Verification Failure (CWE‑295). In environments that rely solely on client certificates for authentication, a party that can reach the listener can connect without presenting a certificate and instantly gain access to data exposed through the connector, causing a breach of confidentiality.

Affected Systems

MongoDB BI Connector with client‑certificate authentication enabled. No specific versions are listed, so all releases that allow a CA file and do not enforce client certs are potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. The EPSS score is not available, and it is not yet listed in CISA’s KEV catalog. The likely attack vector is remote network access to the BI Connector listener: a malicious actor can initiate a TLS connection, omit a certificate, and when the server does not enforce it, obtain an unauthorized session that can read exposed MongoDB data.

Generated by OpenCVE AI on August 29, 2026 at 00:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest MongoDB BI Connector release that enforces client certificates during TLS handshakes.
  • Configure the connector to disallow connections that lack a client certificate, ensuring strict client‑auth enforcement.
  • Limit network exposure of the BI Connector listener to trusted hosts only, reducing the opportunity for an attacker to initiate the connection.

Generated by OpenCVE AI on August 29, 2026 at 00:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb bi Connector
Vendors & Products Mongodb
Mongodb bi Connector

Fri, 28 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.
Title BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mongodb Bi Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-08-28T20:18:14.870Z

Reserved: 2026-08-26T22:07:10.996Z

Link: CVE-2026-81518

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T22:16:54.510

Modified: 2026-08-28T22:16:54.510

Link: CVE-2026-81518

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T00:30:17Z

Weaknesses
  • CWE-295

    Improper Certificate Validation