Description

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-28T22:16:54.247Z",
  "pubdate": "2026-08-28T22:16:54.247Z",
  "executiveSummary": "A denial of service vulnerability exists in the MongoDB Connector for BI where a low-privileged user capable of creating views can disrupt the schema-sampling routine.\nBy crafting a view that intentionally triggers evaluation failures, an attacker causes the sampling logic to misclassify persistent errors as transient.\nOnce retries are exhausted, the schema refresh process terminates prematurely, leaving the mongosqld process in a non-functional state regarding schema discovery.\nThis vulnerability impacts the availability of SQL-based client access to MongoDB data, as the system fails to provide a usable schema for query mapping.\nSuccessful exploitation requires the attacker to have sufficient permissions to create views within a namespace that is subject to the connector's schema-sampling process.\nThe risk is categorized as a service disruption, as the administrative intervention is required to identify the offending view and remove it or modify the exclusion list to restore service availability.",
  "technicalDetails": "The vulnerability resides within the schema-sampling routine of the MongoDB Connector for BI, specifically within the logic governing the evaluation of database views during the discovery phase.\nWhen mongosqld initiates a schema refresh, it iterates through defined views to infer the underlying data structure. The root cause of this vulnerability is the improper error handling and classification during the evaluation of these views.\nAn attacker with the privileges to create a view in a targeted namespace can define a view that consistently fails during evaluation—for instance, by referencing non-existent collections, utilizing unauthorized aggregation stages, or forcing a runtime exception.\nWhen the sampling engine encounters this failing view, it classifies the server-side error as a transient issue. Consequently, the engine initiates a retry mechanism as defined by the current configuration. Because the view is intentionally malformed, these retries are guaranteed to fail.\nUpon reaching the exhaustion of the retry limit, the sampling routine terminates the current schema discovery process. Crucially, the routine does not gracefully handle the partial failure or isolate the problematic view; instead, it ceases the entire refresh operation.\nThis behavior leaves the mongosqld process running, but with an incomplete or stale schema state. Because the SQL layer relies on an accurate schema mapping to translate and execute queries, the service becomes effectively unusable for SQL clients, resulting in a denial of service for all dependent BI tools.\nThe attack flow is straightforward: 1) The attacker identifies a namespace monitored by the BI connector. 2) The attacker creates a malicious view that guarantees evaluation failure. 3) The BI connector triggers a schema sampling refresh. 4) The sampling logic attempts to parse the malicious view, fails, exhausts its retry budget, and aborts the entire refresh operation. 5) SQL client access is subsequently blocked due to the lack of an updated schema. 6) The denial of service persists until an administrator manually deletes the view or updates the configuration to exclude the namespace from the sampling scope."
}