CVE-2026-81521

MediumCVSS 6.5/10Last modified Oct 6, 2026

Description

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-99

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-815228.1A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identif CVE-2026-815234.4A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier CVE-2026-815245.4A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without saniti CVE-2026-815258.1The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before usin CVE-2026-815266.5The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it CVE-2026-815276.5A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregatio CVE-2026-815285.4A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value CVE-2026-815297.1Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an ap CVE-2026-81539.8OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to CVE-2026-815305.6A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material CVE-2026-815316.9An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization rem CVE-2026-815328.8A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement who