CVE-2026-81522

Received Received - Intake

MongoDB C++ Driver Namespace Injection Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: MongoDB, Inc.

Description

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-81522

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongo_cxx_driver	4.5.1
mongodb	mongodb_c++_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This vulnerability involves the MongoDB C++ Driver improperly handling namespace identifiers from untrusted input. Special characters in these identifiers can redirect operations to unintended targets, allowing limited unauthorized read and write access to data belonging to another tenant in the affected application.

Impact Analysis

If you use the MongoDB C++ Driver and build namespace identifiers from untrusted input without validation, attackers could manipulate these identifiers to access data belonging to other tenants. This could lead to unauthorized data exposure or modification within your application.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance may be impacted if sensitive data is exposed or altered due to this issue.

Mitigation Strategies

Update to MongoDB C++11 Driver version r4.5.1 or later to address the namespace identifier validation issue.

Hi! I’m here to help you understand CVE-2026-81522. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70