CVE-2026-76797

Name of the Vulnerable Software and Affected Versions MongoSQL Transition Readiness Tool (affected versions not specified)

Description The tool writes database and collection names into generated CSV reports without neutralizing leading characters that spreadsheet applications interpret as formulas. A user with write privileges on the cluster can create a namespace name that is evaluated as a formula when an operator opens the report. This can lead to the unintended disclosure of report contents or the execution of external content on the operator's workstation. This issue requires generating a report for the affected namespace and opening it in a spreadsheet application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.