CVE-2026-81521: mongodb go driver Resource Injection

Vulnerability summary

CVE-2026-81521 is a high (CVSS 7.1) Resource Injection vulnerability in mongodb go driver. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.6% of scored vulnerabilities.

Timeline

1. 27-08-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

• CWE-99Improper Control of Resource Identifiers ('Resource Injection')The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.