CVE-2026-81526 Cross-database write redirection via unvalidated dotted database name in bulk write namespaces
Attackers can redirect bulk write operations to unintended databases by manipulating dotted names, leading to unauthorized data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81526?
CVE-2026-81526 is a high-severity vulnerability in MongoDB Rust Driver, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.
Weakness: CWE-74
Which versions are affected by CVE-2026-81526?
It affects 1 product.
Products include Mongodb Rust Driver.
How do I fix CVE-2026-81526?
No fix has been published for CVE-2026-81526 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81526 being exploited?
There is no known exploitation of CVE-2026-81526 in the wild and no public exploit code.
Other vulnerabilities in MongoDB Rust Driver
- CVE-2025-11695 Configuration may unexpectedly disable certificate validation
- CVE-2024-6382 Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
- CVE-2026-88024 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver
- CVE-2021-20332 Exposure of Sensitive Information to an Unauthorized Actor in MongoDB Rust Driver