CVE-2026-81522— Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver
Quick assessment
Affected
MongoDB C++ Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB C++ Driver是美国MongoDB公司的一款数据库C++客户端驱动。 MongoDB C++ Driver 3.0.0版本至4.5.1之前版本存在输出处理不当漏洞，该漏洞源于处理调用者提供的命名空间标识符时未进行充分验证，可能导致操作被定向到非预期目标，从而造成对受影响应用另一逻辑租户数据的有限未授权读写访问。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | C++ Driver | 3.0.0< 4.5.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81522
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB C++ Driver 输出处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB C++ Driver是美国MongoDB公司的一款数据库C++客户端驱动。 MongoDB C++ Driver 3.0.0版本至4.5.1之前版本存在输出处理不当漏洞，该漏洞源于处理调用者提供的命名空间标识符时未进行充分验证，可能导致操作被定向到非预期目标，从而造成对受影响应用另一逻辑租户数据的有限未授权读写访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | C++ Driver | 3.0.0 ~ 4.5.1 | - |
|
II. Public POCs for CVE-2026-81522
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81522
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81522 (1)
Vendor Pages for CVE-2026-81522 (1)
Same Patch Batch · MongoDB · 2026-08-27 · 12 CVEs total
| CVE-2026-81525 | 8.1 HIGH | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Dr |
| CVE-2026-81529 | 7.1 HIGH | Connection-option injection via unescaped settings in the canonical MongoDB URL builder |
| CVE-2026-81521 | 6.5 MEDIUM | Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite |
| CVE-2026-81527 | 6.5 MEDIUM | NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation |
| CVE-2026-81526 | 6.5 MEDIUM | Cross-database write redirection via unvalidated dotted database name in bulk write namesp |
| CVE-2026-75159 | 5.9 MEDIUM | MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Ca |
| CVE-2026-81530 | 5.6 MEDIUM | KMS master key exposure via unredacted credential serialization in driver settings string |
| CVE-2026-81528 | 5.4 MEDIUM | NoSQL injection via array replacement bypassing update shape validation in driver write pa |
| CVE-2026-81524 | 5.4 MEDIUM | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driv |
| CVE-2026-75573 | 4.4 MEDIUM | MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Ar |
| CVE-2026-81523 | 4.4 MEDIUM | Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocr |
IV. Related Vulnerabilities
Same product: C++ Driver
-
CVE-2026-106430
Query and rename target confusion via embedded NUL truncatio -
CVE-2026-88034
GridFS data disclosure and deletion via query-operator injec -
CVE-2026-84966
BSON element injection via NUL-embedded document keys in bui -
CVE-2026-84970
Heap over-read or silent misparse via 32-bit truncation of J
Same vendor: MongoDB
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-104004
Collection validators using collation-accepting expressions -
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_
Same weakness: CWE-116
-
CVE-2026-110757
Text::CSV_XS versions before 1.65 for Perl allow record spli -
CVE-2026-110756
Text::CSV_XS versions before 1.65 for Perl drop the end of a -
CVE-2026-18516
Improper Encoding or Escaping of Output in Crafty Controller -
CVE-2026-110592
BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invo -
CVE-2026-102235
Visual Studio Code Remote Code Execution Vulnerability
V. Comments for CVE-2026-81522
No comments yet