AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MongoDBGHSA-c9qr-rh56-vvrc

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

MongoDB

CVE-2026-81524 · Published Aug 27, 2026

Medium5.4
Fix: upgrade to 2.5.1 or later
GitHub advisory

Impact

Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.

Patches

Fixed in C driver 2.5.1.

Workarounds

Validate database and collection names prior to passing into APIs.

References

https://jira.mongodb.org/browse/CDRIVER-6424

Affected versions

PackageAffectedFixed in
MongoDB C Driver
Product
< 2.5.12.5.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)

More MongoDB advisories

All MongoDB
Medium 5.4Aug 27NoSQL injection via array replacement bypassing update shape validation in driver write pathCVE-2026-81528fixed in 3.11.1Medium 6.5Aug 27NoSQL injection in LINQ pipeline translationCVE-2026-81527fixed in 3.11.1Medium 5.6Aug 27KMS master key exposure via unredacted credential serialization in driver settings stringCVE-2026-81530fixed in 3.11.1High 7.1Aug 27Connection-option injection via unescaped settings in the canonical MongoDB URL builderCVE-2026-81529fixed in 3.11.1High 8.1Aug 27Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP DriverCVE-2026-81525fixed in 1.21.4 +1High 7.1Aug 27Cross-database write retargeting via unvalidated dotted database name in Client.BulkWriteCVE-2026-81521fixed in 2.8.2