CVE-2026-81524
Last modified
CVE-2026-81524 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | C Driver | >= 1.0.0, < 2.5.1 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-81524?
How severe is CVE-2026-81524?
How do I fix CVE-2026-81524?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-81518When mongosqld is configured with a client certificate autho…7.5
- CVE-2026-8152Unblu Spark contains an open redirect vulnerability that can…9.3
- CVE-2026-81520A network-reachable client that has not yet authenticated ca…7.5
- CVE-2026-81521The MongoDB Go Driver's client-level bulk write operation ma…6.5
- CVE-2026-81522A weakness in the MongoDB C++ Driver's handling of caller-su…8.1
- CVE-2026-81523A missing input-validation issue in MongoDB libmongocrypt's …4.4
- CVE-2026-81525The MongoDB client library for PHP does not sufficiently san…8.1
- CVE-2026-81526The MongoDB Rust Driver does not neutralize special characte…6.5
- CVE-2026-81527A NoSQL/expression injection weakness exists in the LINQ-to-…6.5
- CVE-2026-81528A MongoDB C# driver document-replacement code path omits the…5.4
- CVE-2026-81529Improper neutralization of delimiters in connection-URL cons…7.1
- CVE-2026-8153OS command injection in Dashboard Server interface in Univer…9.8
Are you affected by CVE-2026-81524?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST