Vulnerability · Published Aug 27, 2026 · Assigned by mongodb
CVE-2026-81522Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver
High 8.1
In plain English
A high-severity security flaw in C++ Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | mongo-cxx-driver | 4.5.1-1 | DEBIAN-CVE-2026-81522 |
| Ubuntu:26.10 | mongo-cxx-driver | no fix listed | UBUNTU-CVE-2026-81522 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | C++ Driver | 3.0.0 – before 4.5.1 |
Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N