CVE-2026-75159 is a double free flaw (CWE-415) in MongoDB Connector for BI. An unauthenticated client that can reach a Kerberos configured deployment may cause mongosqld to terminate. The record rates it Medium at 5.9. Check the release notes for version 2.14.30.
What's affected
The record says MongoDB Connector for BI deployments configured with Kerberos authentication are affected. It does not list affected or fixed version numbers. The reference points to the connector's release notes at an anchor for version 2.14.30, which suggests that is the fixing release. Our fetch of that page returned only the page frame and no release text, so confirm the fixed version in the release notes yourself.
The scope is narrow. You are affected only if you run the BI Connector and have enabled Kerberos authentication. The record scores 5.9 (Medium), with network access, high attack complexity, no login, and availability as the only impact.
How to check if you're exposed
Check the connector version.
mongosqld --version
Then check whether Kerberos is enabled in your mongosqld configuration, for example a GSSAPI authentication mechanism setting. If Kerberos is not used, the described condition does not apply. Check whether the process is reachable from networks other than your analytics tools, since the attacker only needs to reach it.
What to do now
- Open the MongoDB Connector for BI release notes, and confirm the release that fixes this issue. The reference names 2.14.30.
- Upgrade the connector to that release or a later one.
- Restrict network access to mongosqld to the BI tools and users who need it.
- Run mongosqld under a supervisor that restarts it automatically, so a crash is brief.
- Alert when the process restarts unexpectedly.
Why it matters
The weakness is a double free, CWE-415. The record says a crafted authentication exchange reaches a specific GSSAPI error handling condition. Freeing the same memory twice corrupts the allocator state, and a careful process usually terminates, which is the effect the record describes: the connector stops until it restarts.
Double free bugs can sometimes lead to more than a crash. The record claims only an availability impact, so we claim nothing further. The lesson for operators is that error handling in authentication code is a hard area to test. A restart policy and network limits reduce the cost of a crash, but upgrading removes the cause. KEV status is false.
Quick check
Am I affected without Kerberos?
The record describes Kerberos configured deployments, so other setups are outside the stated condition.
What is the fixed version?
The reference points to 2.14.30. Confirm it in the MongoDB release notes.
Sources
Last reviewed: 18 October 2026.
