CVE-2026-106430
Awaiting Analysis Awaiting Analysis - Queue

MongoDB C++ Driver NUL Byte Handling Flaw

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: MongoDB, Inc.

Description
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-106430
EUVD
EUVD-2026-95155

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MongoDB C++ Driver 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MongoDB C++ Driver incorrectly handles field and collection names containing embedded NUL bytes. When such names are used, the driver may interpret them differently than the application, leading to unintended data access or collection renaming. An authenticated attacker could exploit this to read from or modify unintended fields or collections using the application's existing database credentials.

Detection Guidance

This vulnerability involves the MongoDB C++ Driver misinterpreting field and collection names due to embedded NUL bytes. Detection requires reviewing application code and database interactions for improper handling of names containing NUL bytes. No direct network or system commands can detect this issue as it depends on application logic and driver behavior.

Impact Analysis

This vulnerability allows an authenticated attacker to access or modify data in unintended fields or collections. This could lead to unauthorized data exposure, data corruption, or application logic manipulation. The impact depends on the application's use of MongoDB and the permissions of the compromised credentials.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using MongoDB with the C++ Driver may face compliance violations if this flaw is exploited, potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Update the MongoDB C++ Driver to the latest version to address the issue with embedded NUL bytes in field and collection names. Ensure all applications using the driver validate and sanitize input names to prevent manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart