CVE-2026-77586

Katalog CVE

CVSS 8.0 · High EPSS 0,42%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada mongodb bi connector. Skor CVSS 3.1 8.0 (High) menurut mongodb.com.

Deskripsi (NVD)

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can choose a name that closes the quoted identifier early, so that additional SQL text becomes part of the generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

Rincian

Terbit di NVD

28 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mongodb.com/docs/bi-connector/current/release-notes/ advisory vendor