CVE-2026-81521: CWE-99: Improper Control of Resource Identifiers ('Resource Injection') in MongoDB GO Driver

The MongoDB Go Driver's client-level bulk write operation (Client.BulkWrite API) improperly controls resource identifiers by accepting a database name containing reserved separator characters without escaping them. This flaw (CWE-99) allows an attacker who can supply untrusted input as the database name to redirect write operations to databases or collections other than those intended by the application. The vulnerability affects versions >=2.1.0 <2.8.2 and >=2.9.0 <2.9.2. No known exploits are reported in the wild, and no vendor advisory or patch links are provided in the input data.

An attacker able to influence the database name parameter in the BulkWrite API can cause write operations to be executed against unintended databases or collections. This could lead to data corruption or unauthorized data modification within the MongoDB environment. The CVSS 4.0 score of 7.1 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should avoid passing untrusted input directly as database names in the Client.BulkWrite API or implement input validation and sanitization to prevent injection of reserved separator characters.