Description

An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-27T17:19:54.780Z",
  "pubdate": "2026-08-27T17:19:54.780Z",
  "executiveSummary": "This vulnerability involves a denial-of-service (DoS) condition in the MongoDB Connector for BI, specifically affecting the mongosqld process when configured for Kerberos authentication.\nThe issue stems from improper error handling within the GSSAPI authentication handshake mechanism. An unauthenticated remote attacker can trigger a process crash by initiating a specially crafted authentication exchange.\nSuccessful exploitation results in the immediate termination of the mongosqld service, leading to a complete loss of BI Connector availability for all downstream users.\nThe vulnerability requires that the target instance be reachable over the network and configured to support Kerberos authentication.\nBecause the exploit does not require authentication, it presents a significant risk to the availability of business intelligence reporting pipelines that rely on the BI Connector. The attack is easily repeatable and does not require complex preconditions beyond network reachability.\nThe impact is limited to service interruption; there is no evidence of remote code execution or unauthorized data access associated with this specific crash condition.",
  "technicalDetails": "The vulnerability resides within the authentication logic of the mongosqld binary, specifically in the module responsible for handling Generic Security Services Application Program Interface (GSSAPI) exchanges.\nWhen a client initiates a Kerberos authentication request, mongosqld parses the provided authentication tokens. The vulnerability is triggered when the authentication state machine encounters a specific, malformed GSSAPI error condition that the process is not equipped to handle gracefully.\nThe root cause is an unhandled exception or an assertion failure during the error-processing phase of the GSSAPI handshake. Rather than returning an authentication failure message to the client, the process enters an unstable state or reaches a code path that forces a process exit (e.g., an abort or segmentation fault), effectively terminating the service.\nThe attack flow follows these steps: First, the attacker identifies a network-exposed instance of mongosqld that is configured to utilize Kerberos (GSSAPI) authentication. Second, the attacker initiates a standard connection request to the BI Connector. Third, the attacker proceeds to the authentication phase and injects a crafted, malformed GSSAPI authentication payload into the handshake.\nUpon receiving this payload, the mongosqld process attempts to interpret the malformed data within the context of the Kerberos provider. The GSSAPI sub-component fails to sanitize or properly manage the specific error response associated with this input. This error triggers a critical failure within the authentication thread, which propagates to the main execution loop, resulting in a process crash.\nBecause the vulnerability exists in the authentication layer, it occurs before the attacker is required to provide valid credentials, making it exploitable by any unauthenticated entity with network access to the BI Connector port.\nThe post-exploitation impact is limited to the availability domain. The service remains in a terminated state until manual or automated intervention (such as a systemd restart or process monitoring watchdog) restarts the binary. Given that the service does not automatically recover from this crash, the BI connector remains offline indefinitely until administrators respond."
}