CVE-2026-81526: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in MongoDB Rust Driver

The MongoDB Rust Driver version 3.0.0 suffers from improper neutralization of special elements in output used by a downstream component (CWE-74). Specifically, the driver does not sanitize special characters in a target identifier supplied by the caller before embedding it in requests to the MongoDB server. An attacker able to influence this identifier in an application using the driver may cause write operations to be applied to unintended targets within the same deployment, using the application's own credentials. This can lead to unauthorized modification of data belonging to other logical boundaries within the application environment.

An attacker who can control the target identifier in an application using the affected MongoDB Rust Driver can cause write operations to be redirected to unintended targets within the same MongoDB deployment. This results in unauthorized modification of data across logical boundaries, potentially compromising data integrity and application security. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published at this time. Until a patch is available, applications should avoid using untrusted input for target identifiers or implement their own input validation and sanitization to prevent injection of special characters.