CVE-2026-81521

EUVD-2026-67205

27.08.2026, 20:18

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

Resource Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
mongodb	CNA	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 10.22%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
mongodb	go_driver	2.1.0 ≤ 𝑥 < 2.8.2	CNA

Debian Releases

Debian Product

Codename

golang-mongodb-mongo-driver

bookworm	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable

Common Weakness Enumeration

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Vulnerability Media Exposure

[GERMAN] MongoDB Clients: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Clients ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.
Published: 2026-08-27T22:00:00+00:00

References

https://jira.mongodb.org/browse/GODRIVER-4075

https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.2