CVE-2026-81520 (CVSS 7.5)

Description

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

Is your site exposed to CVE-2026-81520?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0024

Probability of exploitation

0.15%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-1088 CWE-1088

References

Other References

https://www.mongodb.com/docs/bi-connector/current/release-notes/

Frequently Asked Questions

What is CVE-2026-81520? +

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-81520? +

CVE-2026-81520 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0024, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-81520? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-8061 7.5

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the …

CVE-2024-8062 7.5

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a …

CVE-2026-89147 7.5

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read …

CVE-2024-12777 5.9

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking …

CVE-2025-4656 3.1

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled …

CVE-2026-81520