CVE-2026-6691: MongoDB C Driver Heap Overflow via GSSAPI Username

A critical heap buffer overflow (CVE-2026-6691) has been identified in the MongoDB C Driver’s Cyrus SASL integration. The National Vulnerability Database reports this vulnerability stems from unsafe string copying during username canonicalization, which can be triggered by untrusted input in the username of a MongoDB URI when authMechanism=GSSAPI is specified. This is a pre-authentication vulnerability, meaning an attacker doesn’t need to authenticate or even initiate a full network session to exploit it.

The CVSSv3.1 score of 7.8 (High) reflects the severe impact: full confidentiality, integrity, and availability compromise are possible. The attack vector is local with user interaction required, but this interaction can be as simple as an application using a malicious URI. The underlying issue, CWE-120 (Buffer Overflow), is a perennial problem and highlights fundamental memory safety failures that still plague critical infrastructure components.

For defenders, this means a potential avenue for arbitrary code execution or denial-of-service on systems running applications that utilize the vulnerable MongoDB C Driver. The pre-authentication nature makes it particularly dangerous, as it lowers the bar for exploitation significantly. Attackers will always target these types of vulnerabilities first because they offer maximum impact with minimal effort.