What’s Vulnerable › Vulnerabilities

CVE-2026-81523: Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-09-17
• Weakness: CWE-74

Description

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

Affected products

• MongoDB libmongocrypt: before 1.20.3 — fixed in 1.20.3

How to fix

Upgrade to a fixed version: MongoDB libmongocrypt 1.20.3. Check the vendor advisory for mitigations.

References

• https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3
• https://jira.mongodb.org/browse/MONGOCRYPT-977

Get alerted when CVE-2026-81523 or the next vulnerability affects your stack