A critical authentication bypass in the MongoDB BI Connector allows unauthenticated remote attackers to access sensitive data due to improper TLS client certificate enforcement.

The mongosqld listener fails to enforce the requirement for a client certificate during the TLS handshake even when configured with a certificate authority file. This allows unauthenticated remote parties to establish a session without presenting a valid certificate.

This vulnerability carries a CVSS score of 7.5, reflecting the risk of unauthorized access to sensitive MongoDB data. In environments relying on certificate-based authentication, this flaw effectively removes the primary security barrier, exposing internal data to any remote party with network access to the listener.

Immediate Action: Update to MongoDB BI Connector version 2.14.31 or later to enforce mandatory client certificate validation.

Proactive Monitoring: Review connection logs for sessions established from unauthorized IP addresses or those lacking valid client certificates.

Compensating Controls: Use network-level access control lists (ACLs) or firewall rules to restrict access to the BI Connector listener to known, authorized client IP addresses.

Public Exploit Available: No

Immediate remediation is required to prevent unauthorized data exposure. Organizations must upgrade to version 2.14.31 and ensure that their security architecture does not rely solely on the BI Connector for access control until the patch is applied.