CVE-2026-81526— Cross-database write redirection via unvalidated dotted database name in bulk write namespaces
Quick assessment
Affected
MongoDB Rust Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB Rust Driver是美国MongoDB公司开源的一套连接数据库的Rust驱动程序。 MongoDB Rust Driver 3.0.0至3.8.2之前版本存在输入验证错误漏洞，该漏洞源于在将调用者提供的目标标识符嵌入发送到服务器的请求之前，未中和其中的特殊字符，可能导致使用应用程序自身的凭据将写操作应用到非预期目标，从而未经授权修改属于应用程序强制执行的另一个逻辑边界的数据。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | Rust Driver | 3.0.0< 3.8.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81526
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-database write redirection via unvalidated dotted database name in bulk write namespaces
Source: CVE Program / CVE List V5
Vulnerability Description
The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB Rust Driver 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB Rust Driver是美国MongoDB公司开源的一套连接数据库的Rust驱动程序。 MongoDB Rust Driver 3.0.0至3.8.2之前版本存在输入验证错误漏洞，该漏洞源于在将调用者提供的目标标识符嵌入发送到服务器的请求之前，未中和其中的特殊字符，可能导致使用应用程序自身的凭据将写操作应用到非预期目标，从而未经授权修改属于应用程序强制执行的另一个逻辑边界的数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | Rust Driver | 3.0.0 ~ 3.8.2 | - |
|
II. Public POCs for CVE-2026-81526
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81526
请登录查看更多情报信息。
Vendor Pages for CVE-2026-81526 (2)
Same Patch Batch · MongoDB · 2026-08-27 · 12 CVEs total
| CVE-2026-81522 | 8.1 HIGH | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Dr |
| CVE-2026-81525 | 8.1 HIGH | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Dr |
| CVE-2026-81529 | 7.1 HIGH | Connection-option injection via unescaped settings in the canonical MongoDB URL builder |
| CVE-2026-81521 | 6.5 MEDIUM | Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite |
| CVE-2026-81527 | 6.5 MEDIUM | NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation |
| CVE-2026-75159 | 5.9 MEDIUM | MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Ca |
| CVE-2026-81530 | 5.6 MEDIUM | KMS master key exposure via unredacted credential serialization in driver settings string |
| CVE-2026-81528 | 5.4 MEDIUM | NoSQL injection via array replacement bypassing update shape validation in driver write pa |
| CVE-2026-81524 | 5.4 MEDIUM | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driv |
| CVE-2026-75573 | 4.4 MEDIUM | MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Ar |
| CVE-2026-81523 | 4.4 MEDIUM | Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocr |
IV. Related Vulnerabilities
Same vendor: MongoDB
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-104004
Collection validators using collation-accepting expressions -
CVE-2026-103965
Fixed values in MongoDB Server $bucket stage may be misread -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_
Same weakness: CWE-74
-
CVE-2026-111223
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via -
CVE-2026-55453
CUPS ipp backend status-line injection can update queue PPD -
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-76182
Jetty TryPathsHandler/Filter路径解析逻辑漏洞 -
CVE-2026-81534
Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authentica
V. Comments for CVE-2026-81526
No comments yet