Read the docs
TI-2026-56243 Aliases CVE-2026-81522

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

Priority MEDIUM 40CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00462 40th percentileScored 2026-11-07
Fix Partial C++ Driver (MongoDB): 4.5.1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBC++ Driver3.0.0 to before 4.5.14.5.1Patch availableCNA
  • C++ Driver VendorMongoDB Affected 3.0.0 to before 4.5.1 Fixed in 4.5.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:c\+\+_driver:*:*:*:*:*:mongodb:*:*3.0.0 to before 4.5.2VulnerableMongoDB
  • cpe:2.3:a:mongodb:c\+\+_driver:*:*:*:*:*:mongodb:*:* Versions 3.0.0 to before 4.5.2 Vulnerable ·MongoDB

Remediation

  • Fix · CNA C++ Driver (MongoDB) Fixed in 4.5.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Not affected: 1 product
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81522
  2. 2026-10-16 Affected versions changed · Red Hat
  3. 2026-10-16 CVSS score added · Red Hat
  4. 2026-10-20 Affected versions changed · Red Hat

References

Advisory 1

Other 1

  • TI-2026-60059 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver CVSS 4.0MEDIUM 6.1
  • TI-2026-58393 Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser CVSS 4.0MEDIUM 5.9
  • TI-2026-58389 BSON element injection via NUL-embedded document keys in builder append CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences