Vulnerability · Published Oct 8, 2026 · Assigned by mongodb
CVE-2026-106430Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
Medium 5.9
In plain English
A medium-severity security flaw in C++ Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | mongo-cxx-driver | 4.6.1-1 | DEBIAN-CVE-2026-106430 |
| Ubuntu:26.10 | mongo-cxx-driver | no fix listed | UBUNTU-CVE-2026-106430 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | C++ Driver | 3.0.0 – before 4.6.1 |
Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N