CVE-2026-75159— MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination
Quick assessment
Affected
MongoDB BI Connector
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB BI Connector是美国MongoDB公司的一款连接商业智能工具与数据库的组件。 MongoDB BI Connector 2.4.0版本至2.14.30之前版本存在资源管理错误漏洞，该漏洞源于特制身份验证交换遇到特定GSSAPI错误处理条件，可能导致未经身份验证的客户端使mongosqld终止，中断BI Connector可用性。
Possible ATT&CK Techniques 1 AI
T1059.001 · PowerShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | BI Connector | 2.4.0< 2.14.30 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75159
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination
Source: CVE Program / CVE List V5
Vulnerability Description
An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
双重释放
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB BI Connector 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB BI Connector是美国MongoDB公司的一款连接商业智能工具与数据库的组件。 MongoDB BI Connector 2.4.0版本至2.14.30之前版本存在资源管理错误漏洞，该漏洞源于特制身份验证交换遇到特定GSSAPI错误处理条件，可能导致未经身份验证的客户端使mongosqld终止，中断BI Connector可用性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | BI Connector | 2.4.0 ~ 2.14.30 | - |
|
II. Public POCs for CVE-2026-75159
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75159
请登录查看更多情报信息。
Same Patch Batch · MongoDB · 2026-08-27 · 12 CVEs total
| CVE-2026-81522 | 8.1 HIGH | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Dr |
| CVE-2026-81525 | 8.1 HIGH | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Dr |
| CVE-2026-81529 | 7.1 HIGH | Connection-option injection via unescaped settings in the canonical MongoDB URL builder |
| CVE-2026-81521 | 6.5 MEDIUM | Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite |
| CVE-2026-81527 | 6.5 MEDIUM | NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation |
| CVE-2026-81526 | 6.5 MEDIUM | Cross-database write redirection via unvalidated dotted database name in bulk write namesp |
| CVE-2026-81530 | 5.6 MEDIUM | KMS master key exposure via unredacted credential serialization in driver settings string |
| CVE-2026-81528 | 5.4 MEDIUM | NoSQL injection via array replacement bypassing update shape validation in driver write pa |
| CVE-2026-81524 | 5.4 MEDIUM | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driv |
| CVE-2026-75573 | 4.4 MEDIUM | MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Ar |
| CVE-2026-81523 | 4.4 MEDIUM | Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocr |
IV. Related Vulnerabilities
Same product: BI Connector
-
CVE-2026-81520
MongoDB Connector for BI Unbounded Authentication Negotiatio -
CVE-2026-81518
BI Connector Optional Client Certificate Verification Allows -
CVE-2026-81517
MongoDB Connector for BI Improper Error Handling of Log Writ -
CVE-2026-81490
MongoDB Connector for BI Improper Error Handling During Sche -
CVE-2026-77586
MongoDB Connector for BI Unescaped Object Names in Generated
Same vendor: MongoDB
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-104004
Collection validators using collation-accepting expressions -
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_
Same weakness: CWE-415
-
CVE-2026-110599
L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importe -
CVE-2026-94370
Memory corruption (double free / use-after-free) vulnerabili -
CVE-2026-95635
Photoshop Desktop | Double Free (CWE-415) -
CVE-2026-108132
Windows Kerberos Elevation of Privilege Vulnerability -
CVE-2026-97830
Windows Internet Information Services Denial of Service Vuln
V. Comments for CVE-2026-75159
No comments yet