CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

Medium 6.9 Published 28 Aug 2026 Updated 31 Aug 2026

Attackers can inject scripts into HTML reports via BI Connector logs, potentially disclosing sensitive data or misleading operators when reports are viewed.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-76798?

CVE-2026-76798 is a medium-severity cross-site scripting vulnerability in MongoDB BI Connector Transition Readiness Report, published on 28 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that report in a browser is required.

Weakness: CWE-79

Which versions are affected by CVE-2026-76798?

It affects 1 product.

Products include Mongodb Mongosql Transition Readiness Tool.

How do I fix CVE-2026-76798?

No fix has been published for CVE-2026-76798 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-76798 being exploited?

There is no known exploitation of CVE-2026-76798 in the wild and no public exploit code.

Sources

Also known as GHSA-5phg-fmwx-665v.