CVE-2026-81523
Received Received - Intake

MongoDB libmongocrypt Schema Selection Issue via Unsanitized Input

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-81523

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mongodb libmongocrypt 1.20.3
mongodb libmongocrypt *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup. It allows a caller-supplied database identifier to be accepted without proper sanitization, which could lead to incorrect schema selection.

Detection Guidance

To detect this vulnerability, check if your system uses MongoDB libmongocrypt versions prior to 1.20.3. Run commands like 'mongocryptd --version' or inspect package managers for libmongocrypt versions. If vulnerable, update to version 1.20.3 or later.

Impact Analysis

The impact is limited to incorrect schema selection, which may result in limited disclosure or modification of information handled by the application. The CVSS v3.1 score of 4.4 indicates low to moderate impact.

Compliance Impact

This vulnerability has limited impact on compliance with standards like GDPR or HIPAA. It only affects schema selection due to improper input validation, which may lead to minor information disclosure or modification. No direct evidence suggests significant compliance risks.

Mitigation Strategies

Update MongoDB libmongocrypt to version 1.20.3 or later to address the input-validation issue in automatic-encryption context setup.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81523. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart