CVE-2026-81521
Received Received - Intake

MongoDB Go Driver Bulk Write Namespace Injection

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-81521

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mongodb mongodb_go_driver v2.8.2
mongodb go_driver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-99 The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MongoDB Go Driver's bulk write operation may accept a database name with a reserved separator character without escaping it. This could cause writes to be directed to unintended databases and collections if untrusted input is used as the database name. Only the Client.BulkWrite API is affected.

Detection Guidance

To detect this vulnerability, inspect applications using the MongoDB Go Driver's Client.BulkWrite API for untrusted database name inputs. Check for improper escaping of reserved separator characters in database names. Review application logs for unexpected database or collection writes.

Impact Analysis

An attacker could manipulate the database name parameter to redirect bulk write operations to unauthorized databases or collections. This may lead to data corruption, unauthorized data access, or unintended modifications in systems using the affected MongoDB Go Driver.

Compliance Impact

This vulnerability could violate data integrity and access control requirements in GDPR and HIPAA. Unauthorized data access or modification may result in non-compliance, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the MongoDB Go Driver to the latest version that patches this vulnerability. Avoid passing untrusted input as a database name in Client.BulkWrite operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81521. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart