Cyber Posture

CVE-2026-6691

High

Published: 06 May 2026

Published
06 May 2026
Modified
06 May 2026
KEV Added
—
Patch
—
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score N/A
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI…

more

with authMechanism=GSSAPI.

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-120

Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.

Security SummaryAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-120

References