CVE-2026-106430: CWE-436: Interpretation Conflict in MongoDB C++ Driver

The MongoDB C++ Driver improperly handles embedded NUL bytes in field and collection names passed to the collection API, discarding content after the NUL byte. This leads to a mismatch in interpretation between the driver and the calling application. An authenticated actor who can influence these names may cause the application to access or rename unintended database fields or collections, leveraging the application's existing database credentials. This vulnerability affects versions >=3.0.0 and <4.6.1 of the MongoDB C++ Driver. No known exploits in the wild have been reported, and no official patch links are provided in the input data.

An authenticated user with limited privileges who can influence field or collection names may cause the application to read or rename unintended data within the database. This could lead to unauthorized data access or modification within the scope of the application's database credentials. The vulnerability does not escalate privileges but can cause logical errors in data handling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should avoid passing field or collection names containing embedded NUL bytes or sanitize inputs to prevent such characters. Monitor vendor communications for updates on patches or official mitigations.