CVE-2026-81518 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

High 8.7 Published 28 Aug 2026 Updated 31 Aug 2026

Remote attackers can bypass client certificate authentication to read MongoDB data when the connector is configured with optional certificate verification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-81518?

CVE-2026-81518 is a high-severity authentication bypass vulnerability in MongoDB BI Connector, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.

Weakness: CWE-295

Which versions are affected by CVE-2026-81518?

It affects 1 product.

Products include Mongodb Bi Connector.

How do I fix CVE-2026-81518?

No fix has been published for CVE-2026-81518 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-81518 being exploited?

There is no known exploitation of CVE-2026-81518 in the wild and no public exploit code.

Sources

Also known as GHSA-2r33-wv3m-hvxf.