AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MongoDBGHSA-65fr-j4p9-vc33

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

MongoDB

CVE-2026-81525 · Published Aug 27, 2026

High8.1
Fix: upgrade to 1.21.4 or later (2 fixed versions below)
GitHub advisory

Impact

Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.

Patches

Fixed in PHP library 1.21.4 and 2.4.1.

Workarounds

Validate database and collection names prior to passing into APIs.

References

https://jira.mongodb.org/browse/PHPLIB-1927

Affected versions

PackageAffectedFixed in
mongodb/mongodb
Product
< 1.21.41.21.4
>= 2.0.0, < 2.4.12.4.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)

More MongoDB advisories

All MongoDB
Medium 5.4Aug 27NoSQL injection via array replacement bypassing update shape validation in driver write pathCVE-2026-81528fixed in 3.11.1Medium 6.5Aug 27NoSQL injection in LINQ pipeline translationCVE-2026-81527fixed in 3.11.1Medium 5.6Aug 27KMS master key exposure via unredacted credential serialization in driver settings stringCVE-2026-81530fixed in 3.11.1High 7.1Aug 27Connection-option injection via unescaped settings in the canonical MongoDB URL builderCVE-2026-81529fixed in 3.11.1High 7.1Aug 27Cross-database write retargeting via unvalidated dotted database name in Client.BulkWriteCVE-2026-81521fixed in 2.8.2Medium 6.5Aug 27Cross-database write redirection via unvalidated dotted database name in bulk write namespacesCVE-2026-81526fixed in 3.8.2