CVE-2026-81524: CWE-99: Improper Control of Resource Identifier ('Resource Injection') in MongoDB C Driver
Description
CVE-2026-81524 is a medium severity vulnerability in the MongoDB C Driver version 1.0.0. It involves improper control of resource identifiers, where special elements in database and collection names supplied by callers are not sanitized. This can allow operations to be directed at unintended resources if untrusted input is used in these name components.
CVSS v4.0
Score 5.3medium
Affected software
MongoDB
C Driver
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-99) in MongoDB C Driver 1.0.0 arises because the driver does not sanitize special elements in caller-supplied database and collection name components when composing the target namespace for operations. Applications that incorporate untrusted input into these components may inadvertently direct operations to resources other than those intended, potentially leading to unauthorized access or manipulation of data.
Potential Impact
An attacker who can influence database or collection name inputs may cause the driver to perform operations on unintended resources. This could lead to unauthorized data access or modification. However, the CVSS score of 5.3 and lack of known exploits in the wild suggest a moderate impact with limited exploitation evidence to date.
Mitigation Recommendations
No official patch or remediation level has been published yet. Users should avoid incorporating untrusted input directly into database or collection name components until a fix or official guidance is available. Monitor the MongoDB vendor advisories for updates regarding patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-08-26T22:13:58.379Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a909cffacd9273b49b2d380
Added to database: 08/27/2026, 20:24:31 UTC
Last enriched: 09/10/2026, 03:54:01 UTC
Last updated: 10/11/2026, 18:48:22 UTC
Views: 64
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.