Overview
CVE-2026-19001 is a critical-severity buffer overflow vulnerability affecting the MongoDB BI Connector ODBC Driver. Rated CVSS 9.8, the flaw allows an application supplying an unusually long catalog, schema, or object name to a metadata retrieval function to trigger a write outside the bounds of a fixed-size stack or heap buffer. This can result in memory corruption within the calling process, potentially enabling arbitrary code execution in the context of the affected application.
The vulnerability was published to the National Vulnerability Database (NVD) on August 12, 2026.
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-19001 |
| CVSS Score | 9.8 (Critical) |
| Affected Component | MongoDB BI Connector ODBC Driver |
| Vulnerability Type | Buffer Overflow (CWE-120) |
| Attack Vector | Network |
| Authentication | None required |
| Published | 2026-08-12 |
Root Cause
The MongoDB BI Connector ODBC Driver fails to validate the length of string parameters passed to metadata retrieval functions such as catalog, schema, and object name lookups. When an application — or a malicious actor controlling input to those functions — supplies a string that exceeds the size of an internal fixed-size buffer, the driver writes beyond the buffer boundary. On vulnerable systems this can corrupt adjacent memory, overwrite return addresses or function pointers, and lead to abnormal process termination or code execution.
Because the ODBC interface is a standard Windows and cross-platform database connectivity API, this vulnerability can be triggered by any application that:
- Uses the MongoDB BI Connector ODBC Driver
- Passes user-controlled or externally-sourced identifiers to metadata-fetching calls (e.g.
SQLTables,SQLColumns,SQLProcedures)
Affected Software
The MongoDB BI Connector ODBC Driver is used to connect SQL-based analytics tools (such as Tableau, Power BI, Excel, MicroStrategy, and others) to MongoDB data through the BI Connector middleware. Organizations using MongoDB Atlas or self-hosted MongoDB with the BI Connector enabled for SQL analytics workloads are at risk.
Check your installed version via your system's ODBC Data Sources applet or driver manager and compare against the fixed release from MongoDB.
Risk Assessment
A CVSS base score of 9.8 places this vulnerability in the Critical tier. The high score reflects:
- No authentication required: The vulnerable code path is reachable without credentials
- Network-reachable attack surface: Any network-accessible application using the driver can be targeted
- High impact across all three pillars: Confidentiality, Integrity, and Availability are all rated High
- Low attack complexity: A single oversized string value is sufficient to trigger the flaw
In environments where the BI Connector is exposed to externally-controlled data (such as user-generated report queries, dynamic schema discovery, or multi-tenant analytics platforms), the exploitability is particularly elevated.
Mitigation
- Apply the vendor patch immediately. MongoDB has issued a fixed version of the BI Connector ODBC Driver. Consult the MongoDB Security Advisories page for the specific fixed version.
- Restrict network access to the BI Connector endpoint. Limit connectivity to trusted analytics clients only.
- Validate and sanitize all input passed to ODBC metadata functions, especially in multi-tenant or user-driven query environments.
- Monitor process crashes or anomalous exits of the BI Connector process, which may indicate exploitation attempts.
- Audit ODBC driver versions across your fleet — ODBC drivers are frequently overlooked in patch management cycles.