CVE-2026-81524
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 27, 2026
- Updated
- Aug 28, 2026
- Reserved
- Aug 26, 2026
Description
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | mongodb |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | mongodb |
Weaknesses
- CWE-99 Improper Control of Resource Identifier ('Resource Injection')
Affected Products
| Product | Versions |
|---|---|
C DriverMongoDB |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.