CVE-2026-81524

EUVD-2026-67208
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.
Resource Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mongodbCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.08%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mongodbc_driver
1.0.0 ≤
𝑥
< 2.5.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
mongo-c-driver
bookworm
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
vulnerable
sid
2.5.1-1
fixed
trixie
no-dsa
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.1
https://jira.mongodb.org/browse/CDRIVER-6424