CVE-2026-81523

MediumCVSS 4.4/10Last modified Sep 17, 2026

Description

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Aug 27, 2026
Last modified
Sep 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-815245.4A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitiCVE-2026-815258.1The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before usinCVE-2026-815266.5The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it CVE-2026-815276.5A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregatioCVE-2026-815285.4A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a valueCVE-2026-815297.1Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an apCVE-2026-81539.8OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker toCVE-2026-815305.6A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material CVE-2026-815316.9An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remCVE-2026-815328.8A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whoCVE-2026-815337.1An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unuCVE-2026-815348.8The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9