CVE-2026-106430: Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Applications using the MongoDB C++ Driver are exposed when an authenticated actor can influence field or collection names passed to the collection API, including names containing an embedded NUL byte.
What access does an attacker need?
The attacker must be authenticated and able to influence a name used by the affected application. The resulting database operations run with the application's existing database credentials.
What could exploitation allow?
An attacker can cause the application to read values from an unintended field or rename an unintended collection because the driver and application may interpret the supplied name differently.