CVE-2026-81522: Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications using the MongoDB C++ Driver are exposed if they construct namespace identifiers from untrusted input and do not validate that input. The impact is cross-tenant access within the affected application's logical tenancy model.
What does an attacker need to exploit this issue?
An attacker needs the ability to supply input that is incorporated into a namespace identifier by the application. The supplied identifier must be accepted without validation of special characters such as dot or NUL.
Are applications that use fixed, application-controlled namespace identifiers affected?
The described condition depends on caller-supplied namespace identifiers built from untrusted input. Applications that do not derive namespace identifiers from untrusted input are not described as affected by this weakness.
What can be done if updating the driver is not immediately possible?
Validate untrusted values before using them to build namespace identifiers, and reject special characters that can alter the intended target, including dot and NUL. Avoid allowing users or tenants to directly control namespace identifier components.
How can teams assess whether they may be affected?
Review code paths that construct MongoDB namespace identifiers and determine whether any component comes from request, user, tenant, or other untrusted input. Pay particular attention to paths where such input can contain dot or NUL characters and influence the selected database target.