CVE-2026-6691
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic.
Risk Assessment
The potential for buffer overflow may lead to remote code execution or system compromise, posing a serious security threat to the organization.
Recommendation
It is recommended to update the MongoDB C Driver to the latest version to mitigate this vulnerability and to avoid using untrusted input in usernames.
Other vulnerabilities in MongoDB C Driver
See all- CVE-2026-81530Medium
A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material to be reproduced verbatim in the driver's human-readable diagnostic representation of client settings, instead of being masked as other secret fields are.
- CVE-2026-81529High
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips it back into client configuration, the untrusted text is serialized without neutralizing URL/option delimiters and then re-parsed as authoritative connection options.
- CVE-2026-81528Medium
A MongoDB C# driver document-replacement code path omits the element-name/shape validation that equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements.
- CVE-2026-81527Medium
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. Special elements in application-supplied values are not properly escaped before the query is sent to the database.
- CVE-2026-81524Medium
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application incorporating untrusted input into these names can have operations directed at a resource other than intended.
- CVE-2026-81522High
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may have its operation directed at a different target than intended.
- CVE-2026-9100Medium
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).
Original NVD description (English source)
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.