Vulnerability · Published Aug 27, 2026 · Assigned by mongodb
CVE-2026-75159MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination
Medium 5.9
In plain English
A medium-severity double free in BI Connector from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | BI Connector | 2.4.0 – before 2.14.30 |
Weakness: CWE-415 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H