AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MongoDBGHSA-8g9w-8cw9-q38w

Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

MongoDB

CVE-2026-81523 · Published Aug 27, 2026

Medium4.4
Fix: upgrade to 1.20.3 or later
GitHub advisory

Impact

Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.

Patches

Fixed in libmongocrypt 1.20.3.

Workarounds

Validate database and collection names prior to passing into APIs.

References

https://jira.mongodb.org/browse/MONGOCRYPT-977

Affected versions

PackageAffectedFixed in
libmongocrypt
Product
< 1.20.31.20.3
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)

More MongoDB advisories

All MongoDB
Medium 5.4Aug 27NoSQL injection via array replacement bypassing update shape validation in driver write pathCVE-2026-81528fixed in 3.11.1Medium 6.5Aug 27NoSQL injection in LINQ pipeline translationCVE-2026-81527fixed in 3.11.1Medium 5.6Aug 27KMS master key exposure via unredacted credential serialization in driver settings stringCVE-2026-81530fixed in 3.11.1High 7.1Aug 27Connection-option injection via unescaped settings in the canonical MongoDB URL builderCVE-2026-81529fixed in 3.11.1High 8.1Aug 27Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP DriverCVE-2026-81525fixed in 1.21.4 +1High 7.1Aug 27Cross-database write retargeting via unvalidated dotted database name in Client.BulkWriteCVE-2026-81521fixed in 2.8.2