CVE-2026-81526

Received Received - Intake

MongoDB Rust Driver Target Identifier Injection

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-28

Generated

2026-08-28

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-81526

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_rust_driver	3.8.2
mongodb	mongodb_rust_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The MongoDB Rust Driver has a flaw where it does not properly sanitize special characters in target identifiers provided by the caller. This allows an attacker who can influence these identifiers to redirect write operations to unintended targets within the same deployment using the application's credentials. The issue specifically involves improper validation of database and collection names, missing checks for dots and NUL bytes.

Detection Guidance

This vulnerability is specific to applications using the MongoDB Rust Driver. Detection involves checking if your application uses a vulnerable version of the driver (prior to 3.8.2). Inspect dependency files like Cargo.toml for the mongodb crate version. No direct network detection commands are applicable as this is a code-level issue.

Impact Analysis

If exploited, this vulnerability could allow unauthorized modification of data belonging to another application or user within the same MongoDB deployment. Attackers could alter or delete data they should not have access to, potentially leading to data corruption, loss of integrity, or unauthorized changes in the database.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating principles of data integrity and confidentiality required by GDPR and HIPAA. Organizations using the affected driver may face compliance violations, potential fines, and reputational damage due to compromised data protection.

Mitigation Strategies

Upgrade to MongoDB Rust Driver version 3.8.2 or later. This version patches the improper validation of database and collection names. Verify the upgrade by checking the version in your dependency files and rebuilding your application.

Hi! I’m here to help you understand CVE-2026-81526. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70