Vulnerability · Published Aug 28, 2026 · Assigned by mongodb
CVE-2026-81518BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections
High 7.5
In plain English
A high-severity improper certificate validation in BI Connector from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | BI Connector | 0 – before 2.14.31 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N