CVE-2026-81521
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace. An application passing untrusted input as a database name could have the write directed at a database and collection other than intended.
Risk Assessment
This may lead to data being written to the wrong location, compromising data integrity and potentially causing unauthorized modifications.
Recommendation
Upgrade the MongoDB Go Driver to a patched version. Validate and sanitize user-supplied database names before use in write operations.
Other vulnerabilities in MongoDB Go Driver
See all- CVE-2026-107325Medium
Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service.
- CVE-2026-107324Medium
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service.
- CVE-2026-88031High
The GridFS component of the MongoDB Go Driver contains an improper neutralization of special elements in data query logic, where a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may cause all GridFS file chunks in the affected bucket to be removed.
Original NVD description (English source)
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS