What’s Vulnerable › Vulnerabilities

CVE-2026-81521: Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-10-06
• Weakness: CWE-99

Description

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

Affected products

• MongoDB Go Driver: from 2.1.0 before 2.8.2 — fixed in 2.8.2

How to fix

Upgrade to a fixed version: MongoDB Go Driver 2.8.2. Check the vendor advisory for mitigations.

References

• https://jira.mongodb.org/browse/GODRIVER-4075
• https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.2

Get alerted when CVE-2026-81521 or the next vulnerability affects your stack