MongoDBGHSA-c9qr-rh56-vvrc
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
Medium5.4CVE-2026-81524 · Published Aug 27, 2026
### Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. ### Patches Fixed in C driver 2.5.1. ### Workarounds Validate database and collection names prior to passing into APIs. ### References https://jira.mongodb.org/browse/CDRIVER-6424
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB C Driver Product | < 2.5.1 | 2.5.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 27 | NoSQL injection via array replacement bypassing update shape validation in driver write path | Medium5.4 | 3.11.1 |
| Aug 27 | NoSQL injection in LINQ pipeline translation | Medium6.5 | 3.11.1 |
| Aug 27 | KMS master key exposure via unredacted credential serialization in driver settings string | Medium5.6 | 3.11.1 |
| Aug 27 | Connection-option injection via unescaped settings in the canonical MongoDB URL builder | High7.1 | 3.11.1 |
| Aug 27 | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver | High8.1 | 1.21.4+1 more |
| Aug 27 | Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite | High7.1 | 2.8.2 |