Vulnerability-Lookup

WID-SEC-W-2026-3066

Vulnerability from csaf_certbund - Published: 2026-08-27 22:00 - Updated: 2026-08-31 22:00

Summary

MongoDB Clients: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: MongoDB ist ein Open-Source-Dokumentendatenbank.

Angriff: Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Clients ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2026-75159

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-75573

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81521

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81522

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81523

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81524

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81525

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81526

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81527

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81528

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81529

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

CVE-2026-81530

Affected products

Known affected 12 products

Product	Identifier	Version
Open Source MongoDB PHP Library <2.4.1 Open Source / MongoDB		PHP Library <2.4.1
Open Source MongoDB PHP Library <1.21.4 Open Source / MongoDB		PHP Library <1.21.4
Open Source MongoDB Rust Driver <3.8.2 Open Source / MongoDB		Rust Driver <3.8.2
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Open Source MongoDB BI Connector <2.14.30 Open Source / MongoDB		BI Connector <2.14.30
Open Source MongoDB PHP Driver <1.21.6 Open Source / MongoDB		PHP Driver <1.21.6
Open Source MongoDB C# Driver <3.11.1 Open Source / MongoDB		C# Driver <3.11.1
Open Source MongoDB C++ Driver <4.5.1 Open Source / MongoDB		C++ Driver <4.5.1
Open Source MongoDB GO Driver <2.8.2 Open Source / MongoDB		GO Driver <2.8.2
Open Source MongoDB PHP Driver <2.4.1 Open Source / MongoDB		PHP Driver <2.4.1
Open Source MongoDB C Driver <2.5.1 Open Source / MongoDB		C Driver <2.5.1
Open Source MongoDB libmongocrypt <1.20.3 Open Source / MongoDB		libmongocrypt <1.20.3

References

28 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.mongodb.com/docs/bi-connector/current…	external
https://jira.mongodb.org/browse/GODRIVER-4075	external
https://jira.mongodb.org/browse/CXX-3552	external
https://github.com/mongodb/mongo-cxx-driver/relea…	external
https://jira.mongodb.org/browse/MONGOCRYPT-977	external
https://github.com/mongodb/libmongocrypt/releases…	external
https://jira.mongodb.org/browse/CDRIVER-6424	external
https://github.com/mongodb/mongo-c-driver/release…	external
https://jira.mongodb.org/browse/PHPLIB-1927	external
https://github.com/mongodb/mongo-php-library/rele…	external
https://github.com/mongodb/mongo-php-library/rele…	external
https://github.com/mongodb/mongo-php-driver/relea…	external
https://github.com/mongodb/mongo-php-driver/relea…	external
https://jira.mongodb.org/browse/RUST-2467	external
https://github.com/mongodb/mongo-rust-driver/rele…	external
https://www.nuget.org/packages/MongoDB.Driver/3.11.1	external
https://jira.mongodb.org/browse/CSHARP-6156	external
https://jira.mongodb.org/browse/CSHARP-6158	external
https://jira.mongodb.org/browse/CSHARP-6171	external
https://jira.mongodb.org/browse/CSHARP-6164	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "MongoDB ist ein Open-Source-Dokumentendatenbank.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Clients ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder Denial-of-Service-Zust\u00e4nde herbeizuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-3066 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3066.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-3066 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3066"
      },
      {
        "category": "external",
        "summary": "MongoDB Connector for BI Release Notes vom 2026-08-27",
        "url": "https://www.mongodb.com/docs/bi-connector/current/release-notes/"
      },
      {
        "category": "external",
        "summary": "MongoDB Go Driver JIRA GODRIVER-4075 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/GODRIVER-4075"
      },
      {
        "category": "external",
        "summary": "MongoDB C++ Driver JIRA CXX-3552 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/CXX-3552"
      },
      {
        "category": "external",
        "summary": "MongoDB C++ Driver Release Notes r4.5.1 vom 2026-08-27",
        "url": "https://github.com/mongodb/mongo-cxx-driver/releases/tag/r4.5.1"
      },
      {
        "category": "external",
        "summary": "MongoDB libmongocrypt JIRA MONGOCRYPT-977 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/MONGOCRYPT-977"
      },
      {
        "category": "external",
        "summary": "MongoDB libmongocrypt Release Notes 1.20.3 vom 2026-08-27",
        "url": "https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3"
      },
      {
        "category": "external",
        "summary": "MongoDB C Driver JIRA CDRIVER-6424 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/CDRIVER-6424"
      },
      {
        "category": "external",
        "summary": "MongoDB C Driver Release Notes 2.5.1 vom 2026-08-27",
        "url": "https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.1"
      },
      {
        "category": "external",
        "summary": "MongoDB PHP Library JIRA PHPLIB-1927 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/PHPLIB-1927"
      },
      {
        "category": "external",
        "summary": "MongoDB PHP Library Release Notes 1.21.4 vom 2026-08-27",
        "url": "https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4"
      },
      {
        "category": "external",
        "summary": "MongoDB PHP Library Release Notes 2.4.1 vom 2026-08-27",
        "url": "https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1"
      },
      {
        "category": "external",
        "summary": "MongoDB PHP Driver Release Notes 1.21.6 vom 2026-08-27",
        "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6"
      },
      {
        "category": "external",
        "summary": "MongoDB PHP Driver Release Notes 2.4.1 vom 2026-08-27",
        "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1"
      },
      {
        "category": "external",
        "summary": "MongoDB Rust Driver JIRA RUST-2467 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/RUST-2467"
      },
      {
        "category": "external",
        "summary": "MongoDB Rust Driver Release Notes v3.8.2 vom 2026-08-27",
        "url": "https://github.com/mongodb/mongo-rust-driver/releases/tag/v3.8.2"
      },
      {
        "category": "external",
        "summary": "MongoDB C# Driver Release Notes 3.11.1 vom 2026-08-27",
        "url": "https://www.nuget.org/packages/MongoDB.Driver/3.11.1"
      },
      {
        "category": "external",
        "summary": "MongoDB C# Driver JIRA CSHARP-6156 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/CSHARP-6156"
      },
      {
        "category": "external",
        "summary": "MongoDB C# Driver JIRA CSHARP-6158 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/CSHARP-6158"
      },
      {
        "category": "external",
        "summary": "MongoDB C# Driver JIRA CSHARP-6171 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/CSHARP-6171"
      },
      {
        "category": "external",
        "summary": "MongoDB C# Driver JIRA CSHARP-6164 vom 2026-08-27",
        "url": "https://jira.mongodb.org/browse/CSHARP-6164"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-276EF95C83 vom 2026-09-01",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-276ef95c83"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-2210B463DC vom 2026-09-01",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2210b463dc"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-92974D6AB3 vom 2026-09-01",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-92974d6ab3"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-EAC81454B1 vom 2026-09-01",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-eac81454b1"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-4C8991A29D vom 2026-09-01",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-4c8991a29d"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-FEC1BD0E65 vom 2026-09-01",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-fec1bd0e65"
      }
    ],
    "source_lang": "en-US",
    "title": "MongoDB Clients: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-31T22:00:00.000+00:00",
      "generator": {
        "date": "2026-09-01T08:07:43.476+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-3066",
      "initial_release_date": "2026-08-27T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-08-27T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-08-31T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Fedora aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74178",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "BI Connector \u003c2.14.30",
                "product": {
                  "name": "Open Source MongoDB BI Connector \u003c2.14.30",
                  "product_id": "T058761"
                }
              },
              {
                "category": "product_version",
                "name": "BI Connector 2.14.30",
                "product": {
                  "name": "Open Source MongoDB BI Connector 2.14.30",
                  "product_id": "T058761-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:bi_connector__2.14.30"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "GO Driver \u003c2.8.2",
                "product": {
                  "name": "Open Source MongoDB GO Driver \u003c2.8.2",
                  "product_id": "T058762"
                }
              },
              {
                "category": "product_version",
                "name": "GO Driver 2.8.2",
                "product": {
                  "name": "Open Source MongoDB GO Driver 2.8.2",
                  "product_id": "T058762-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:go_driver__2.8.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "C++ Driver \u003c4.5.1",
                "product": {
                  "name": "Open Source MongoDB C++ Driver \u003c4.5.1",
                  "product_id": "T058763"
                }
              },
              {
                "category": "product_version",
                "name": "C++ Driver 4.5.1",
                "product": {
                  "name": "Open Source MongoDB C++ Driver 4.5.1",
                  "product_id": "T058763-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:c_driver__4.5.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "libmongocrypt \u003c1.20.3",
                "product": {
                  "name": "Open Source MongoDB libmongocrypt \u003c1.20.3",
                  "product_id": "T058764"
                }
              },
              {
                "category": "product_version",
                "name": "libmongocrypt 1.20.3",
                "product": {
                  "name": "Open Source MongoDB libmongocrypt 1.20.3",
                  "product_id": "T058764-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:libmongocrypt__1.20.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "C Driver \u003c2.5.1",
                "product": {
                  "name": "Open Source MongoDB C Driver \u003c2.5.1",
                  "product_id": "T058765"
                }
              },
              {
                "category": "product_version",
                "name": "C Driver 2.5.1",
                "product": {
                  "name": "Open Source MongoDB C Driver 2.5.1",
                  "product_id": "T058765-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:c_driver__2.5.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Library \u003c2.4.1",
                "product": {
                  "name": "Open Source MongoDB PHP Library \u003c2.4.1",
                  "product_id": "T058767"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Library 2.4.1",
                "product": {
                  "name": "Open Source MongoDB PHP Library 2.4.1",
                  "product_id": "T058767-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_library__2.4.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Library \u003c1.21.4",
                "product": {
                  "name": "Open Source MongoDB PHP Library \u003c1.21.4",
                  "product_id": "T058768"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Library 1.21.4",
                "product": {
                  "name": "Open Source MongoDB PHP Library 1.21.4",
                  "product_id": "T058768-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_library__1.21.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Rust Driver \u003c3.8.2",
                "product": {
                  "name": "Open Source MongoDB Rust Driver \u003c3.8.2",
                  "product_id": "T058770"
                }
              },
              {
                "category": "product_version",
                "name": "Rust Driver 3.8.2",
                "product": {
                  "name": "Open Source MongoDB Rust Driver 3.8.2",
                  "product_id": "T058770-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:rust_driver__3.8.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "C# Driver \u003c3.11.1",
                "product": {
                  "name": "Open Source MongoDB C# Driver \u003c3.11.1",
                  "product_id": "T058771"
                }
              },
              {
                "category": "product_version",
                "name": "C# Driver 3.11.1",
                "product": {
                  "name": "Open Source MongoDB C# Driver 3.11.1",
                  "product_id": "T058771-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:c_driver__3.11.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Driver \u003c1.21.6",
                "product": {
                  "name": "Open Source MongoDB PHP Driver \u003c1.21.6",
                  "product_id": "T058772"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Driver 1.21.6",
                "product": {
                  "name": "Open Source MongoDB PHP Driver 1.21.6",
                  "product_id": "T058772-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_driver__1.21.6"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Driver \u003c2.4.1",
                "product": {
                  "name": "Open Source MongoDB PHP Driver \u003c2.4.1",
                  "product_id": "T058773"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Driver 2.4.1",
                "product": {
                  "name": "Open Source MongoDB PHP Driver 2.4.1",
                  "product_id": "T058773-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_driver__2.4.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MongoDB"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-75159",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-75159"
    },
    {
      "cve": "CVE-2026-75573",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-75573"
    },
    {
      "cve": "CVE-2026-81521",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81521"
    },
    {
      "cve": "CVE-2026-81522",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81522"
    },
    {
      "cve": "CVE-2026-81523",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81523"
    },
    {
      "cve": "CVE-2026-81524",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81524"
    },
    {
      "cve": "CVE-2026-81525",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81525"
    },
    {
      "cve": "CVE-2026-81526",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81526"
    },
    {
      "cve": "CVE-2026-81527",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81527"
    },
    {
      "cve": "CVE-2026-81528",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81528"
    },
    {
      "cve": "CVE-2026-81529",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81529"
    },
    {
      "cve": "CVE-2026-81530",
      "product_status": {
        "known_affected": [
          "T058767",
          "T058768",
          "T058770",
          "74178",
          "T058761",
          "T058772",
          "T058771",
          "T058763",
          "T058762",
          "T058773",
          "T058765",
          "T058764"
        ]
      },
      "release_date": "2026-08-27T22:00:00.000+00:00",
      "title": "CVE-2026-81530"
    }
  ]
}

CVE-2026-75159 (GCVE-0-2026-75159)

Vulnerability from cvelistv5 – Published: 2026-08-27 15:58 – Updated: 2026-08-27 19:29

Title

MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination

Summary

An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 19:28 UTC

CWE

CWE-415 - Double Free

Assigner

mongodb mitre root

References

1 reference

URL	Tags
https://www.mongodb.com/docs/bi-connector/current…

Impacted products

1 product

Vendor	Product	Version
MongoDB	BI Connector	Affected: 2.4.0 , < 2.14.30 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75159",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T19:28:51.090506Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T19:29:27.529Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BI Connector",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "2.14.30",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts."
            }
          ],
          "value": "An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415: Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T15:58:38.517Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://www.mongodb.com/docs/bi-connector/current/release-notes/#mongodb-connector-for-bi-2.14.30"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-75159",
    "datePublished": "2026-08-27T15:58:38.517Z",
    "dateReserved": "2026-08-17T19:11:21.383Z",
    "dateUpdated": "2026-08-27T19:29:27.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75573 (GCVE-0-2026-75573)

Vulnerability from cvelistv5 – Published: 2026-08-27 16:01 – Updated: 2026-08-27 18:46

Title

MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied

Summary

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

Severity

4.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 18:46 UTC

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

mongodb mitre root

References

1 reference

URL	Tags
https://www.mongodb.com/docs/bi-connector/current…

Impacted products

1 product

Vendor	Product	Version
MongoDB	BI Connector	Affected: 2.12.0 , < 2.14.30 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75573",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T18:46:04.893435Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T18:46:12.847Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BI Connector",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "2.14.30",
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key."
            }
          ],
          "value": "In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T16:01:55.302Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://www.mongodb.com/docs/bi-connector/current/release-notes/#mongodb-connector-for-bi-2.14.30"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-75573",
    "datePublished": "2026-08-27T16:01:55.302Z",
    "dateReserved": "2026-08-17T22:00:14.773Z",
    "dateUpdated": "2026-08-27T18:46:12.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81521 (GCVE-0-2026-81521)

Vulnerability from cvelistv5 – Published: 2026-08-27 18:31 – Updated: 2026-08-28 15:52

Title

Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

Summary

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:52 UTC

CWE

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Assigner

mongodb mitre root

References

2 references

URL	Tags
https://jira.mongodb.org/browse/GODRIVER-4075
https://pkg.go.dev/go.mongodb.org/mongo-driver/v2…

Impacted products

1 product

Vendor	Product	Version
MongoDB	GO Driver	Affected: 2.1.0 , < 2.8.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81521",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:52:01.062590Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:52:13.039Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GO Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "2.8.2",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The MongoDB Go Driver\u0027s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected."
            }
          ],
          "value": "The MongoDB Go Driver\u0027s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-99",
              "description": "CWE-99: Improper Control of Resource Identifiers (\u0027Resource Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T20:41:59.025Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/GODRIVER-4075"
        },
        {
          "url": "https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.2"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81521",
    "datePublished": "2026-08-27T18:31:45.450Z",
    "dateReserved": "2026-08-26T22:13:12.343Z",
    "dateUpdated": "2026-08-28T15:52:13.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81522 (GCVE-0-2026-81522)

Vulnerability from cvelistv5 – Published: 2026-08-27 18:32 – Updated: 2026-08-29 03:55

Title

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

Summary

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 00:00 UTC

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

mongodb mitre root

References

2 references

URL	Tags
https://jira.mongodb.org/browse/CXX-3552
https://github.com/mongodb/mongo-cxx-driver/relea…

Impacted products

1 product

Vendor	Product	Version
MongoDB	C++ Driver	Affected: 3.0.0 , < 4.5.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81522",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-29T03:55:54.810Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C++ Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "4.5.1",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A weakness in the MongoDB C++ Driver\u0027s handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application."
            }
          ],
          "value": "A weakness in the MongoDB C++ Driver\u0027s handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T20:41:59.743Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CXX-3552"
        },
        {
          "url": "https://github.com/mongodb/mongo-cxx-driver/releases/tag/r4.5.1"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81522",
    "datePublished": "2026-08-27T18:32:23.151Z",
    "dateReserved": "2026-08-26T22:13:42.143Z",
    "dateUpdated": "2026-08-29T03:55:54.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81523 (GCVE-0-2026-81523)

Vulnerability from cvelistv5 – Published: 2026-08-27 18:32 – Updated: 2026-08-28 15:51

Title

Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

Summary

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:50 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

mongodb mitre root

References

2 references

URL	Tags
https://jira.mongodb.org/browse/MONGOCRYPT-977
https://github.com/mongodb/libmongocrypt/releases…

Impacted products

1 product

Vendor	Product	Version
MongoDB	libmongocrypt	Affected: 1.0.0 , < 1.20.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81523",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:50:43.186458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:51:12.001Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.20.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A missing input-validation issue in MongoDB libmongocrypt\u0027s automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application."
            }
          ],
          "value": "A missing input-validation issue in MongoDB libmongocrypt\u0027s automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T20:42:00.300Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-977"
        },
        {
          "url": "https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81523",
    "datePublished": "2026-08-27T18:32:24.206Z",
    "dateReserved": "2026-08-26T22:13:50.099Z",
    "dateUpdated": "2026-08-28T15:51:12.001Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81524 (GCVE-0-2026-81524)

Vulnerability from cvelistv5 – Published: 2026-08-27 18:32 – Updated: 2026-08-28 15:50

Title

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

Summary

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:49 UTC

CWE

CWE-99 - Improper Control of Resource Identifier ('Resource Injection')

Assigner

mongodb mitre root

References

2 references

URL	Tags
https://jira.mongodb.org/browse/CDRIVER-6424
https://github.com/mongodb/mongo-c-driver/release…

Impacted products

1 product

Vendor	Product	Version
MongoDB	C Driver	Affected: 1.0.0 , < 2.5.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:49:53.561189Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:50:10.011Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "2.5.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended."
            }
          ],
          "value": "A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-99",
              "description": "CWE-99: Improper Control of Resource Identifier (\u0027Resource Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T20:42:01.035Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CDRIVER-6424"
        },
        {
          "url": "https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.1"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81524",
    "datePublished": "2026-08-27T18:32:25.355Z",
    "dateReserved": "2026-08-26T22:13:58.379Z",
    "dateUpdated": "2026-08-28T15:50:10.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81525 (GCVE-0-2026-81525)

Vulnerability from cvelistv5 – Published: 2026-08-27 18:32 – Updated: 2026-08-28 15:49

Title

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

Summary

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:48 UTC

CWE

CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

Assigner

mongodb mitre root

References

5 references

URL	Tags
https://jira.mongodb.org/browse/PHPLIB-1927
https://github.com/mongodb/mongo-php-library/rele…
https://github.com/mongodb/mongo-php-library/rele…
https://github.com/mongodb/mongo-php-driver/relea…
https://github.com/mongodb/mongo-php-driver/relea…

Impacted products

2 products

Vendor	Product	Version
MongoDB	PHP Library	Affected: 0 , < 1.21.4 (semver) Affected: 2.0.0 , < 2.4.1 (semver)
MongoDB	PHP Extension	Affected: 0 , < 1.21.6 (semver) Affected: 2.0.0 , < 2.4.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81525",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:48:47.805241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:49:03.964Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PHP Library",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.21.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PHP Extension",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.21.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended."
            }
          ],
          "value": "The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T20:42:01.763Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/PHPLIB-1927"
        },
        {
          "url": "https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4"
        },
        {
          "url": "https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1"
        },
        {
          "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6"
        },
        {
          "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81525",
    "datePublished": "2026-08-27T18:32:26.493Z",
    "dateReserved": "2026-08-26T22:14:05.297Z",
    "dateUpdated": "2026-08-28T15:49:03.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81526 (GCVE-0-2026-81526)

Vulnerability from cvelistv5 – Published: 2026-08-27 18:32 – Updated: 2026-08-28 15:48

Title

Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

Summary

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:47 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

mongodb mitre root

References

2 references

URL	Tags
https://jira.mongodb.org/browse/RUST-2467
https://github.com/mongodb/mongo-rust-driver/rele…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Rust Driver	Affected: 3.0.0 , < 3.8.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81526",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:47:49.591838Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:48:02.435Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Rust Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "3.8.2",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application\u0027s own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application."
            }
          ],
          "value": "The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application\u0027s own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T20:42:02.501Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/RUST-2467"
        },
        {
          "url": "https://github.com/mongodb/mongo-rust-driver/releases/tag/v3.8.2"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Cross-database write redirection via unvalidated dotted database name in bulk write namespaces",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81526",
    "datePublished": "2026-08-27T18:32:27.704Z",
    "dateReserved": "2026-08-26T22:14:12.179Z",
    "dateUpdated": "2026-08-28T15:48:02.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81527 (GCVE-0-2026-81527)

Vulnerability from cvelistv5 – Published: 2026-08-27 18:32 – Updated: 2026-08-28 15:46

Title

NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

Summary

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:46 UTC

CWE

CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

Assigner

mongodb mitre root

References

2 references

URL	Tags
https://jira.mongodb.org/browse/CSHARP-6156
https://www.nuget.org/packages/MongoDB.Driver/3.11.1

Impacted products

1 product

Vendor	Product	Version
MongoDB	C# Driver	Affected: 2.14.0 , < 3.11.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81527",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:46:31.570186Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:46:55.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C# Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "3.11.1",
              "status": "affected",
              "version": "2.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered."
            }
          ],
          "value": "A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T22:34:50.443Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CSHARP-6156"
        },
        {
          "url": "https://www.nuget.org/packages/MongoDB.Driver/3.11.1"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81527",
    "datePublished": "2026-08-27T18:32:28.926Z",
    "dateReserved": "2026-08-26T22:14:18.098Z",
    "dateUpdated": "2026-08-28T15:46:55.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81528 (GCVE-0-2026-81528)

Vulnerability from cvelistv5 – Published: 2026-08-27 18:32 – Updated: 2026-08-28 15:45

Title

NoSQL injection via array replacement bypassing update shape validation in driver write path

Summary

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:45 UTC

CWE

CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

Assigner

mongodb mitre root

References

2 references

URL	Tags
https://jira.mongodb.org/browse/CSHARP-6158
https://www.nuget.org/packages/MongoDB.Driver/3.11.1

Impacted products

1 product

Vendor	Product	Version
MongoDB	C# Driver	Affected: 2.9.0 , < 3.11.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81528",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:45:07.396731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:45:22.840Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C# Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "3.11.1",
              "status": "affected",
              "version": "2.9.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application\u0027s own database credentials. Applications using strongly-typed document mappings are not affected."
            }
          ],
          "value": "A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application\u0027s own database credentials. Applications using strongly-typed document mappings are not affected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T22:34:51.114Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CSHARP-6158"
        },
        {
          "url": "https://www.nuget.org/packages/MongoDB.Driver/3.11.1"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "NoSQL injection via array replacement bypassing update shape validation in driver write path",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81528",
    "datePublished": "2026-08-27T18:32:30.215Z",
    "dateReserved": "2026-08-26T22:14:24.585Z",
    "dateUpdated": "2026-08-28T15:45:22.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

WID-SEC-W-2026-3066

CVE-2026-75159 (GCVE-0-2026-75159)

CVE-2026-75573 (GCVE-0-2026-75573)

CVE-2026-81521 (GCVE-0-2026-81521)

CVE-2026-81522 (GCVE-0-2026-81522)

CVE-2026-81523 (GCVE-0-2026-81523)

CVE-2026-81524 (GCVE-0-2026-81524)

CVE-2026-81525 (GCVE-0-2026-81525)

CVE-2026-81526 (GCVE-0-2026-81526)

CVE-2026-81527 (GCVE-0-2026-81527)

CVE-2026-81528 (GCVE-0-2026-81528)

Tags

Sightings

Nomenclature