CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
Attackers can redirect database operations to unintended namespaces via injection in PHP driver namespace strings, risking cross-tenant data access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81525?
CVE-2026-81525 is a high-severity vulnerability in MongoDB PHP Extension, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.
Weakness: CWE-943
Which versions are affected by CVE-2026-81525?
4 open source packages ship an affected version, including mongodb/mongodb. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
mongodb/mongodb Packagist | All versions | 1.21.4 |
mongodb/mongodb Packagist | All versions | 1.21.4 |
mongodb/mongodb Packagist | From 2.0.0 | 2.4.1 |
mongodb/mongodb Packagist | From 2.0.0 | 2.4.1 |
Products include Mongodb Php Driver, Mongodb Php Library.
How do I fix CVE-2026-81525?
Upgrade mongodb/mongodb to a fixed version for your release line: 1.21.4 or 2.4.1.
Is CVE-2026-81525 being exploited?
There is no known exploitation of CVE-2026-81525 in the wild and no public exploit code.
Other vulnerabilities in MongoDB PHP Extension
- CVE-2026-84968 Heap out-of-bounds read via corrupt nested BSON in field path error message
- CVE-2026-106436 Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
- CVE-2026-6811 PHP Stack Exhaustion
- CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
Sources
Also known as CLSA-2026-1790259386, DEBIAN-CVE-2026-81525, GHSA-65fr-j4p9-vc33, UBUNTU-CVE-2026-81525.