CVE-2026-81522

The MongoDB C++ Driver improperly handles special characters in caller-supplied namespace identifiers (database and collection names), a CWE-116 improper-escaping weakness. The flaw is triggered when an application constructs a namespace from untrusted input without validating it, allowing crafted characters to redirect the database operation to a different namespace than the one intended. An attacker who can influence that input gains limited unauthorized read and write access to data belonging to another logical tenant of the application; the CVSS 4.0 score of 8.6 reflects network reachability, low required privileges, and high confidentiality and integrity impact. Applications built on the MongoDB C++ Driver — particularly multi-tenant applications that derive namespaces from user input — are affected, though the specific affected version range is not stated in the available data. No public proof of concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS currently estimates a 0.3% probability of exploitation within 30 days.

What to do: Upgrade the MongoDB C++ Driver to the fixed release identified in MongoDB's advisory and rebuild any applications that statically link or bundle it. Audit application code for places where database or collection names are assembled from untrusted input, and as an interim mitigation strictly validate namespace identifiers (rejecting special characters) and enforce per-tenant database/collection boundaries. Check with application vendors to confirm whether their products embed the C++ driver and whether updated builds are available.