CVE-2026-81490

HighCVSS 7.7/10Last modified Sep 29, 2026

Description

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Aug 28, 2026
Last modified
Sep 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-814917.3A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_CVE-2026-815057.1Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizesCVE-2026-815076.5ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroidCVE-2026-815084.3ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dpCVE-2026-81515.4The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackersCVE-2026-815157.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 untiCVE-2026-815167.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 untiCVE-2026-815177.5An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection loCVE-2026-815187.5When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake bCVE-2026-81529.3Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu SpaCVE-2026-815207.5A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beCVE-2026-815216.5The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator charact
CVE-2026-81490: High severity, CVSS 7.7 | Vulnix