What is CVE-2026-81521?

CVE-2026-81521 is a medium-severity vulnerability in MongoDB Go Driver, classified under Resource Injection. CVSS score: 6.5/10. Published 2026-08-27.

How severe is CVE-2026-81521?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in MongoDB Go Driver

CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Mongodb Go Driver

Weakness classification (CWE)

CWE-99 — Resource Injection

References

cna@mongodb.com
cna@mongodb.com

Frequently asked questions

What is CVE-2026-81521?: CVE-2026-81521 is a medium-severity vulnerability in MongoDB Go Driver, classified under Resource Injection. CVSS score: 6.5/10. Published 2026-08-27.
How severe is CVE-2026-81521?: Medium severity. CVSS v3 base score is 6.5 out of 10.