CVE-2026-81522: Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

Published Aug 27, 2026
·
Updated

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

Affected Software

1 affected component
MongoDB MongoDB C++ Driver

Event History

Aug 27, 2026
CVE Published
via MITRE·06:32 PM
Data Sourced
via MITRE·06:32 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which applications are realistically exposed?

Applications using the MongoDB C++ Driver are exposed if they construct namespace identifiers from untrusted input and do not validate that input. The impact is cross-tenant access within the affected application's logical tenancy model.

2

What does an attacker need to exploit this issue?

An attacker needs the ability to supply input that is incorporated into a namespace identifier by the application. The supplied identifier must be accepted without validation of special characters such as dot or NUL.

3

Are applications that use fixed, application-controlled namespace identifiers affected?

The described condition depends on caller-supplied namespace identifiers built from untrusted input. Applications that do not derive namespace identifiers from untrusted input are not described as affected by this weakness.

4

What can be done if updating the driver is not immediately possible?

Validate untrusted values before using them to build namespace identifiers, and reject special characters that can alter the intended target, including dot and NUL. Avoid allowing users or tenants to directly control namespace identifier components.

5

How can teams assess whether they may be affected?

Review code paths that construct MongoDB namespace identifiers and determine whether any component comes from request, user, tenant, or other untrusted input. Pay particular attention to paths where such input can contain dot or NUL characters and influence the selected database target.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203