{"id":"CVE-2026-81522","summary":"Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver","details":"A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.","modified":"2026-08-30T03:30:54.028069524Z","published":"2026-08-27T18:32:23.151Z","database_specific":{"cna_assigner":"mongodb","cwe_ids":["CWE-116"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81522.json"},"references":[{"type":"WEB","url":"https://github.com/mongodb/mongo-cxx-driver/releases/tag/r4.5.1"},{"type":"WEB","url":"https://jira.mongodb.org/browse/CXX-3552"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81522.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81522"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mongodb/mongo-cxx-driver","events":[{"introduced":"f17d4f3109b4c9609528ec824bf0d57139e2ad82"},{"fixed":"a163ce324ab34d36edab5c5f69ea903859572d27"}],"database_specific":{"extracted_events":[{"introduced":"3.0.0"},{"fixed":"4.5.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["r4.5.0","r4.4.0","r4.3.0","r4.2.0","r4.1.0","r4.0.0","r3.11.0","r3.9.0","r3.8.0","r3.7.0","r3.7.0-beta1","r3.6.0-rc0","r3.5.0","r3.4.0","r3.3.0","r3.3.0-rc0","r3.2.0","r3.2.0-rc1","r3.2.0-rc0","r3.1.0","r3.1.0-rc0","r3.0.3","r3.0.2","r3.0.1","r3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81522.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}