Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite

High7.1CVE-2026-81521 · Published Aug 27, 2026

### Impact When calling [Client.BulkWrite](https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.1/mongo#Client.BulkWrite), a caller-controlled database name containing period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application. ### Patches Upgrade to Go Driver v2.8.2 or later. ### Workarounds Users can manually validate database and collection names before calling [Client.BulkWrite](https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.1/mongo#Client.BulkWrite) using code like the following. ```go func validateBulkWrites(writes []mongo.ClientBulkWrite) error { for i, w := range writes { if strings.ContainsRune(w.Database, '.') { return fmt.Errorf( "invalid database name %q in write %d: database names cannot contain '.'", w.Database, i, ) } } return nil } ``` ### References * [GODRIVER-4075](https://jira.mongodb.org/browse/GODRIVER-4075) * https://github.com/mongodb/mongo-go-driver/blob/v2.8.1/mongo/client.go#L954-L964