CVE-2026-77586

Name of the Vulnerable Software and Affected Versions MongoDB Connector for BI (affected versions not specified)

Description MongoDB object names, including collection, field, and index names, are inserted into the quoted identifiers of the DDL (Data Definition Language) text returned by SHOW CREATE statements without escaping the identifier delimiter. This allows a user with write permissions to a sampled MongoDB collection to create a name that prematurely closes the quoted identifier, injecting additional SQL text into the generated output. If this output is subsequently executed by an operator or automated tool on a SQL server, the injected text is executed with the privileges of that session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.