The MongoDB Connector for BI contains an unbounded authentication negotiation flaw where an unauthenticated network client can start a SASL login exchange and then stop the process. Because the negotiation loop has no overall timeout and the read from the client has no deadline, each such session retains a worker thread, a client connection slot, and associated backend database connections until the process is restarted. Repeating this behavior consumes the configured connection capacity and can prevent legitimate users from establishing new sessions. This flaw is an example of CWE‑1088.

The vulnerability affects the MongoDB Connector for Business Intelligence. No specific version information is provided, so all releases of the Connector that utilize the SASL authentication handshake are potentially vulnerable until an official fix is released.

The base CVSS score of 8.7 shows a high severity rating. The attack vector is network‑based and does not require authentication or privileged access. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Any unauthenticated client on the network can repeatedly trigger the exploit, meaning that the risk of exploitation is significant in environments where the BI Connector is exposed to untrusted networks.