An unauthenticated attacker can trigger a permanent denial of service in MongoDB BI Connector by exhausting system storage via excessive connection logging.

This vulnerability involves an unhandled exception (CWE-248) that occurs when log rotation or writing fails due to disk exhaustion. An unauthenticated attacker can reach the mongosqld port and trigger sufficient log activity to crash the service, which then prevents the process from restarting until manual operator intervention occurs.

Successful exploitation results in a complete denial of service for all SQL clients relying on the BI Connector, causing significant operational disruption. With a CVSS score of 7.5, this high-severity flaw poses a direct threat to data accessibility and business continuity, as the crash persists across service restarts until storage is manually cleared.

Immediate Action: Update the MongoDB BI Connector to version 2.14.31 or later to implement the necessary error handling and stability improvements.

Proactive Monitoring: Monitor disk usage on servers hosting the BI Connector and implement alerts for sudden spikes in log file growth or unexpected service termination.

Compensating Controls: Restrict network access to the BI Connector port (mongosqld) using firewalls or access control lists to ensure only authorized clients can establish connections.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to service availability due to the ease of triggering a persistent denial of service. Administrators should prioritize upgrading to the fixed version immediately and ensure that network access is strictly limited to known, trusted clients to prevent unauthorized actors from reaching the vulnerable interface.