CVE-2026-81526CWE-74

CVE-2026-81526

Medium · published August 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00404 · 33.5th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-08-28T00:18Z
Affected products (1)
ProductVersionsFixed in
mongodb/rust_driver≥ 3.0.0, < 3.8.23.8.2
References (2)
https://github.com/mongodb/mongo-rust-driver/releases/tag/v3.8.2 · [email protected]https://jira.mongodb.org/browse/RUST-2467 · [email protected]
EPSS history
Timeline
  • 27 AUG 18:32Z
    Cross-database write redirection via unvalidated dotted database name in bulk write namespaces
    cvelistv5