What is CVE-2026-76794?

CVE-2026-76794 is a medium-severity vulnerability in MongoDB Bi Connector Transition Readiness Report, classified under Cross-site Scripting. CVSS score: 4.6/10. Published 2026-08-28.

How severe is CVE-2026-76794?

Medium severity. CVSS v3 base score is 4.6 out of 10.

XSS in MongoDB Bi Connector Transition Readiness Report

CVE-2026-76794

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N.

Affected products

Mongodb Bi Connector Transition Readiness Report

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-76794?: CVE-2026-76794 is a medium-severity vulnerability in MongoDB Bi Connector Transition Readiness Report, classified under Cross-site Scripting. CVSS score: 4.6/10. Published 2026-08-28.
How severe is CVE-2026-76794?: Medium severity. CVSS v3 base score is 4.6 out of 10.