CVE-2026-81523CWE-74

CVE-2026-81523

Medium · published August 28, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
2.0 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00098 · 0.7th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-08-28T00:18Z
Affected products (1)
ProductVersionsFixed in
mongodb/libmongocrypt< 1.20.31.20.3
References (2)
https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3 · [email protected]https://jira.mongodb.org/browse/MONGOCRYPT-977 · [email protected]
EPSS history
Timeline
  • 27 AUG 18:32Z
    Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
    cvelistv5