CVE-2026-81521: Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications are exposed if they use the MongoDB Go Driver's Client.BulkWrite API and pass untrusted or insufficiently validated input as the database name. Other APIs are not identified as affected.
What access does an attacker need to exploit this?
An attacker needs a way to influence the database name supplied to Client.BulkWrite. The affected operation also requires the privileges represented by the CVSS vector's low-privilege requirement.
Are default deployments affected?
The issue depends on application behavior rather than a stated default configuration. Deployments that do not pass attacker-controlled database names to Client.BulkWrite are not described as exposed.
What can be done if updating is not immediately possible?
Do not use untrusted input directly as a database name for Client.BulkWrite. Restrict database names to an application-defined allowlist and reject names containing the reserved separator character.
How can teams identify potentially affected code?
Review code for Client.BulkWrite calls and trace the source of the database-name value used for each operation. Treat calls as potentially affected when that value can be influenced by external input or is not constrained to approved database names.