Skip to content
Heist/ feed
Back to feed
High

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

Type: advisorySources: OSV

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-81522
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 19:12 UTC · Revision 1

Source evidence

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

core-osv · Original source

Published 27 Aug 2026, 18:32 UTC

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

osv:CVE-2026-81522
Complete source record
{
  "id": "811878e93debf03b531a9c6ac4dc3eb312cf2731c5bbc1eb07d5946008fb2796",
  "url": "https://osv.dev/vulnerability/CVE-2026-81522",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver",
    "summary": "A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.",
    "evidence": "osv:CVE-2026-81522",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-81522",
      "aliases": [
        "CVE-2026-81522"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/mongodb/mongo-cxx-driver",
              "type": "GIT",
              "events": [
                {
                  "introduced": "f17d4f3109b4c9609528ec824bf0d57139e2ad82"
                },
                {
                  "fixed": "fd256a7017f4e49f48571a3d97a630a3b8cf75bf"
                },
                {
                  "fixed": "a163ce324ab34d36edab5c5f69ea903859572d27"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:mongodb:c\\+\\+_driver:*:*:*:*:*:mongodb:*:*",
                    "range": [
                      {
                        "introduced": "3.0.0"
                      },
                      {
                        "fixed": "4.5.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "a163ce324ab34d36edab5c5f69ea903859572d27"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "r4.5.1"
                  }
                ]
              }
            }
          ],
          "versions": [
            "r4.5.0",
            "r4.4.0",
            "r4.3.0",
            "r4.2.0",
            "r4.1.0",
            "r4.0.0",
            "r3.11.0",
            "r3.9.0",
            "r3.8.0",
            "r3.7.0",
            "r3.7.0-beta1",
            "r3.6.0-rc0",
            "r3.5.0",
            "r3.4.0",
            "r3.3.0",
            "r3.3.0-rc0",
            "r3.2.0",
            "r3.2.0-rc1",
            "r3.2.0-rc0",
            "r3.1.0",
            "r3.1.0-rc0",
            "r3.0.3",
            "r3.0.2",
            "r3.0.1",
            "r3.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81522.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.620655815Z",
      "provider": "osv",
      "references": [
        "https://github.com/mongodb/mongo-cxx-driver/releases/tag/r4.5.1",
        "https://jira.mongodb.org/browse/CXX-3552",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81522.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-81522"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-116"
        ],
        "cna_assigner": "mongodb",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81522.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-81522",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 520195,
  "published_at": "2026-08-27T18:32:23.151+00:00"
}