CVE-2026-81523— Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
Quick assessment
Affected
MongoDB libmongocrypt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB libmongocrypt是美国MongoDB公司开源的一个加密操作库。 MongoDB libmongocrypt 1.0.0版本至1.20.3之前版本存在输入验证错误漏洞，该漏洞源于自动加密上下文设置中缺少输入验证，允许调用者提供的数据库标识符未经验证接受，可能导致错误模式选择，进而有限披露或修改应用程序处理的信息。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1567 · Exfiltration Over Web ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | libmongocrypt | 1.0.0< 1.20.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81523
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
Source: CVE Program / CVE List V5
Vulnerability Description
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB libmongocrypt 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB libmongocrypt是美国MongoDB公司开源的一个加密操作库。 MongoDB libmongocrypt 1.0.0版本至1.20.3之前版本存在输入验证错误漏洞，该漏洞源于自动加密上下文设置中缺少输入验证，允许调用者提供的数据库标识符未经验证接受，可能导致错误模式选择，进而有限披露或修改应用程序处理的信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | libmongocrypt | 1.0.0 ~ 1.20.3 | - |
|
II. Public POCs for CVE-2026-81523
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81523
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-81523 (1)
Vendor Pages for CVE-2026-81523 (1)
Same Patch Batch · MongoDB · 2026-08-27 · 12 CVEs total
| CVE-2026-81522 | 8.1 HIGH | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Dr |
| CVE-2026-81525 | 8.1 HIGH | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Dr |
| CVE-2026-81529 | 7.1 HIGH | Connection-option injection via unescaped settings in the canonical MongoDB URL builder |
| CVE-2026-81521 | 6.5 MEDIUM | Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite |
| CVE-2026-81527 | 6.5 MEDIUM | NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation |
| CVE-2026-81526 | 6.5 MEDIUM | Cross-database write redirection via unvalidated dotted database name in bulk write namesp |
| CVE-2026-75159 | 5.9 MEDIUM | MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Ca |
| CVE-2026-81530 | 5.6 MEDIUM | KMS master key exposure via unredacted credential serialization in driver settings string |
| CVE-2026-81528 | 5.4 MEDIUM | NoSQL injection via array replacement bypassing update shape validation in driver write pa |
| CVE-2026-81524 | 5.4 MEDIUM | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driv |
| CVE-2026-75573 | 4.4 MEDIUM | MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Ar |
IV. Related Vulnerabilities
Same product: libmongocrypt
-
CVE-2026-106434
Unrecognized payload acceptance in explicit decryption in Mo -
CVE-2026-106433
Heap corruption via duplicate masterKey fields in MongoDB li -
CVE-2026-106429
Application denial of service via malformed KMS endpoint in -
CVE-2026-84962
Authenticated KMS request forgery via CRLF injection in GCP -
CVE-2026-84971
Persistent client crash loop via undersized FLE2 insert-upda
Same vendor: MongoDB
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-104004
Collection validators using collation-accepting expressions -
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_
Same weakness: CWE-74
-
CVE-2026-111223
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via -
CVE-2026-55453
CUPS ipp backend status-line injection can update queue PPD -
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-76182
Jetty TryPathsHandler/Filter路径解析逻辑漏洞 -
CVE-2026-81534
Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authentica
V. Comments for CVE-2026-81523
No comments yet