CVE-2026-81522 HIGH

CVE-2026-81522: Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

Vendor Mongodb
Product C++ Driver
Weakness CWE-116
Published August 27, 2026
Last update August 29, 2026

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

Key dates

02Disclosure timeline

August 27, 2026 CVE published
August 29, 2026 Record updated