CVE-2026-81526: Cross-database write redirection via unvalidated dotted database name in bulk write namespaces
The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the MongoDB Rust Driver are exposed when an actor can influence a target identifier used in bulk write namespaces. The impact is limited to unintended targets within the same MongoDB deployment that the application's credentials can write to.
What access does an attacker need to exploit it?
An attacker needs the ability to influence the target identifier supplied by the application. Exploitation does not require user interaction, but requests are made using the application's own MongoDB credentials.
What is the impact of successful exploitation?
Successful exploitation can redirect write operations to another logical boundary in the same deployment, resulting in unauthorized data modification. The available information does not indicate confidentiality disclosure or service availability impact.
What can be done while patching is pending?
Ensure untrusted actors cannot control bulk write namespace target identifiers, and validate or restrict those identifiers before they are passed to the driver. Restrict the application's database credentials so they cannot write to unintended databases or logical boundaries.
How can I determine whether my application is affected?
Review bulk write code paths for caller-supplied target identifiers that are embedded in namespaces, particularly where identifiers can contain special characters such as dots. The referenced MongoDB Rust Driver release is v3.8.2.