CVE-2026-81524: Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the MongoDB C Driver are exposed when they place untrusted input into database-name or collection-name components used to build operation namespaces. Applications that do not use untrusted values for those components are not identified as affected by the provided information.
What does an attacker need to exploit it?
An attacker needs the ability to influence a database or collection name component supplied by the application. The vulnerability is remotely exploitable with low attack complexity, but it requires privileges in the affected application context.
What is the practical impact of successful exploitation?
An attacker may cause an operation to be directed to a database or collection other than the application intended. The reported impact includes limited confidentiality and integrity effects, with no availability impact.
What can be done before updating the driver?
Do not construct database or collection name components from untrusted input. Validate or strictly allowlist such values before passing them to the driver, including rejecting special dot and NUL elements.
Is a fixed release identified?
The provided reference points to the MongoDB C Driver 2.5.1 release. No affected-version range or explicit fixed-version statement is included in the provided data.