Log in Start free

Vulnerability · Published Aug 27, 2026 · Assigned by mongodb

CVE-2026-81525Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

High 8.1

In plain English

A high-severity security flaw in PHP Extension from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 57.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php-mongodbno fix listedDEBIAN-CVE-2026-81525
Debian:13php-mongodbno fix listedDEBIAN-CVE-2026-81525
Debian:14php-mongodbno fix listedDEBIAN-CVE-2026-81525
Packagistmongodb/mongodb1.21.4GHSA-65fr-j4p9-vc33
Packagistmongodb/mongodb2.4.1GHSA-65fr-j4p9-vc33
Ubuntu:22.04:LTSphp-mongodbno fix listedUBUNTU-CVE-2026-81525
Ubuntu:24.04:LTSphp-mongodbno fix listedUBUNTU-CVE-2026-81525
Ubuntu:26.04:LTSphp-mongodbno fix listedUBUNTU-CVE-2026-81525
Ubuntu:26.10php-mongodbno fix listedUBUNTU-CVE-2026-81525

Affected products (as reported)

VendorProductVersions
MongoDB PHP Library 0 – before 1.21.42.0.0 – before 2.4.1
MongoDB PHP Extension 0 – before 1.21.62.0.0 – before 2.4.1

Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References