How severe is CVE-2026-77184?

CVE-2026-77184 has a CVSS 3.x base score of 5.2, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.

Is CVE-2026-77184 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-77184?

CVE-2026-77184 affects Mongodb Bi Connector. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-77184?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-77184 published?

CVE-2026-77184 was published on 2026-08-28 and last updated on 2026-09-29.

CVE-2026-77184

CVE-2026-77184 is a medium-severity vulnerability in Mongodb Bi Connector with a CVSS 3.x base score of 5.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-89.

Key facts

Severity: Medium (CVSS 3.x base score 5.2)
CVSS v4: 5.7
EPSS exploit prediction: 0% (21st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-89
Affected product: Mongodb Bi Connector
Published: 2026-08-28
Last modified: 2026-09-29

Description

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in deployments configured to build their SQL schema from those validators, can cause additional SQL text to be embedded in that generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

Frequently asked questions

What is CVE-2026-77184?: In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in deployments configured to build their SQL schema from those validators, can cause additional SQL text to be embedded in that generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.
How severe is CVE-2026-77184?: CVE-2026-77184 has a CVSS 3.x base score of 5.2, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.
Is CVE-2026-77184 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-77184?: CVE-2026-77184 affects Mongodb Bi Connector. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-77184?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-77184 published?: CVE-2026-77184 was published on 2026-08-28 and last updated on 2026-09-29.

References

https://www.mongodb.com/docs/bi-connector/current/release-notes/

Affected products (1)

cpe:2.3:a:mongodb:bi_connector:*:*:*:*:*:*:*:*

More vulnerabilities in Mongodb Bi Connector

CVE-2026-77586 — High (CVSS 8.0): In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted…
CVE-2026-81490 — High (CVSS 7.7): A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the…
CVE-2026-81520 — High (CVSS 7.5): A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session…
CVE-2026-81518 — High (CVSS 7.5): When mongosqld is configured with a client certificate authority file, the listener requests a client certificate…
CVE-2026-81517 — High (CVSS 7.5): An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough…
CVE-2026-75159 — Medium (CVSS 5.9): An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication…

All CVEs affecting Mongodb Bi Connector →

Other CWE-89 (SQL Injection) vulnerabilities

CVE-2026-74820 — Critical (CVSS 10.0): ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This…
CVE-2026-20030 — Critical (CVSS 10.0): As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team…
CVE-2026-72811 — Critical (CVSS 10.0): SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query…
CVE-2026-72851 — Critical (CVSS 10.0): Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with…
CVE-2026-72899 — Critical (CVSS 10.0): Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that…
CVE-2026-72898 — Critical (CVSS 10.0): Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint…

Browse all CWE-89 (SQL Injection) vulnerabilities →