HIGH 7.1 NVD

CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

References

https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.2

Published: 2026-08-27 · Source: NVD · Feed updated: 2026-08-27

This high severity vulnerability with a CVSS score of 7.1 was published on 2026-08-27 via NVD.

vulnfeed aggregates 11337 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.