MongoDBGHSA-8g9w-8cw9-q38w
Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
Medium4.4CVE-2026-81523 · Published Aug 27, 2026
### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. ### Patches Fixed in libmongocrypt 1.20.3. ### Workarounds Validate database and collection names prior to passing into APIs. ### References https://jira.mongodb.org/browse/MONGOCRYPT-977
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| libmongocrypt Product | < 1.20.3 | 1.20.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 27 | NoSQL injection via array replacement bypassing update shape validation in driver write path | Medium5.4 | 3.11.1 |
| Aug 27 | NoSQL injection in LINQ pipeline translation | Medium6.5 | 3.11.1 |
| Aug 27 | KMS master key exposure via unredacted credential serialization in driver settings string | Medium5.6 | 3.11.1 |
| Aug 27 | Connection-option injection via unescaped settings in the canonical MongoDB URL builder | High7.1 | 3.11.1 |
| Aug 27 | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver | High8.1 | 1.21.4+1 more |
| Aug 27 | Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite | High7.1 | 2.8.2 |