CVE-2026-81524

Awaiting Analysis Awaiting Analysis - Queue

MongoDB C Driver Namespace Injection Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-28

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81524

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongo_c_driver	2.5.1
mongodb	mongodb_c_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-99	The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Attack-Flow Graph

Executive Summary

This vulnerability is in the MongoDB C Driver where special elements like dots or null bytes in database or collection names are not properly sanitized. This allows untrusted input to redirect operations to unintended resources.

Detection Guidance

To detect this vulnerability, check if your MongoDB C Driver version is below 2.5.1. Run the command: mongoc_version or check the library version linked in your application. If the version is older, the system is likely vulnerable.

Impact Analysis

An attacker could manipulate database or collection names to access or modify data they shouldn't, leading to unauthorized data exposure or corruption. Applications using untrusted input for these names are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance breaches if sensitive data is exposed due to improper input handling.

Mitigation Strategies

Upgrade the MongoDB C Driver to version 2.5.1 or later. This version includes validation for database and collection names to prevent injection or parsing issues. Verify the update by checking the library version in your application.

Hi! I’m here to help you understand CVE-2026-81524. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70