CVE-2026-81521

The MongoDB Go Driver fails to escape reserved separator characters in a caller-supplied database name before using it to build the target namespace for a client-level bulk write, a resource identifier control flaw (CWE-99). It is triggered when a Go application passes untrusted input, such as a user-controlled string, as the database name to the Client.BulkWrite API. An attacker who controls that input can redirect the write operations to a database and collection other than the one the application intended, injecting or corrupting data with the application's privileges; per the CVSS vector, the impact is integrity-only (high integrity impact, no confidentiality impact), so the attacker cannot read other namespaces. Only Go applications that use the Client.BulkWrite API with attacker-influenced database names are affected; uses with hardcoded, trusted database names are not meaningfully exposed. There is no known exploitation, no public proof of concept, and the flaw is not in CISA KEV, with EPSS estimating only a 0.2% probability of exploitation within 30 days.

What to do: Audit Go codebases for calls to Client.BulkWrite and determine whether the database name derives from user or external input; if so, validate or escape it (e.g., restrict to a safe character set) or use a trusted internal mapping from input to database names. Upgrade to the latest patched driver release published by MongoDB once available (the fixed version is not specified in the source data). No exploitation has been observed, so this can be handled in a normal patch cycle unless your application fits the vulnerable usage pattern.