CVE-2026-81526

CVE-2026-81526 is an injection flaw (CWE-74) in the MongoDB Rust Driver, which fails to neutralize special characters in a caller-supplied target identifier before embedding it into the request it sends to the server. An attacker who can influence that identifier — for example by supplying untrusted input that an application uses to choose where it writes data — can redirect write operations to an unintended target within the same MongoDB deployment, using the application's own credentials. The result is unauthorized modification of data (high integrity impact per the 7.1 CVSS 4.0 score) that may cross a logical boundary the application enforces, without confidentiality loss. Any application built with the affected MongoDB Rust Driver is potentially affected, though the available data does not specify affected or fixed version numbers. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and EPSS assigns a low 0.2% probability of exploitation within 30 days.

What to do: Identify Rust applications using the MongoDB Rust Driver and check whether write-target identifiers (e.g., database or collection names) derive from user-controllable input; if so, validate or whitelist allowed characters now as an interim mitigation. Upgrade to the fixed driver version specified in MongoDB's advisory for CVE-2026-81526 when published, and review audit logs for writes landing in unexpected databases or collections within the same deployment.