Cross-database write redirection via unvalidated dotted database name in bulk write namespaces
Medium6.5CVE-2026-81526 · Published Aug 27, 2026
### Impact The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application. ### Patches Database and collection names are validated in version 3.8.2 and higher. ### Workarounds Validate the database and collection names before passing to driver. ### References [RUST-2467](https://jira.mongodb.org/browse/RUST-2467), [Fix](https://github.com/mongodb/mongo-rust-driver/pull/1778/changes/3334082d83ad76c7a412ac01a46bf2de92a2b9e4), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-81526)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mongodb crates.io | >= 3.0.0, < 3.8.2 | 3.8.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-74
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 27 | NoSQL injection via array replacement bypassing update shape validation in driver write path | Medium5.4 | 3.11.1 |
| Aug 27 | NoSQL injection in LINQ pipeline translation | Medium6.5 | 3.11.1 |
| Aug 27 | KMS master key exposure via unredacted credential serialization in driver settings string | Medium5.6 | 3.11.1 |
| Aug 27 | Connection-option injection via unescaped settings in the canonical MongoDB URL builder | High7.1 | 3.11.1 |
| Aug 27 | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver | High8.1 | 1.21.4+1 more |
| Aug 27 | Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite | High7.1 | 2.8.2 |