CVE-2026-81523
Last modified
CVE-2026-81523 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.. EPSS estimates a 0.07% chance of exploitation in the next 30 days.
Description
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | libmongocrypt | >= 1.0.0, < 1.20.3 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-81523?
How severe is CVE-2026-81523?
How do I fix CVE-2026-81523?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-81517An unauthenticated party able to reach the port of a MongoDB…7.5
- CVE-2026-81518When mongosqld is configured with a client certificate autho…7.5
- CVE-2026-8152Unblu Spark contains an open redirect vulnerability that can…9.3
- CVE-2026-81520A network-reachable client that has not yet authenticated ca…7.5
- CVE-2026-81521The MongoDB Go Driver's client-level bulk write operation ma…6.5
- CVE-2026-81522A weakness in the MongoDB C++ Driver's handling of caller-su…8.1
- CVE-2026-81524A weakness in the MongoDB C Driver allows special elements i…5.4
- CVE-2026-81525The MongoDB client library for PHP does not sufficiently san…8.1
- CVE-2026-81526The MongoDB Rust Driver does not neutralize special characte…6.5
- CVE-2026-81527A NoSQL/expression injection weakness exists in the LINQ-to-…6.5
- CVE-2026-81528A MongoDB C# driver document-replacement code path omits the…5.4
- CVE-2026-81529Improper neutralization of delimiters in connection-URL cons…7.1
Are you affected by CVE-2026-81523?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST