# CVE-2026-81520: MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion

> CVE-2026-81520: MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion. CVSS 7.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-81520
Last updated: 2026-09-29T19:14:21Z

- Published: 2026-08-28 20:22 UTC · Updated: 2026-09-29 19:14 UTC · Assigner: mongodb
- CVSS: 7.5 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS: 0.42%, 36th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-1088

## Description

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

## Affected vendors and products

- MongoDB: BI Connector

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-81520)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-81520)
- [https://www.mongodb.com/docs/bi-connector/current/release-notes/](https://www.mongodb.com/docs/bi-connector/current/release-notes/)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-81520 · Markdown: https://rewindex.com/cve/CVE-2026-81520.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-81520 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:17:02.314Z