EUVD-2026-67205Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via app layer (AV:N), low complexity; PR:L because attacker must control app input; integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.
AnalysisAI
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the application uses the Client.BulkWrite API from go.mongodb.org/mongo-driver/v2 specifically - single-collection write APIs are not affected; (2) the application passes a caller-supplied or otherwise untrusted string as the database name argument without prior sanitization; and (3) the attacker has the ability to influence that database name input, typically through an API parameter, configuration endpoint, or multi-tenant identifier field. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1, reflecting high integrity impact reachable over the network with low privilege. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker interacts with a Go web service that exposes a multi-tenant API where the database name is derived from a user-supplied tenant identifier. By supplying a tenant name such as 'legit.admin', the attacker causes the MongoDB Go Driver's Client.BulkWrite to construct the namespace 'legit.admin.orders' instead of 'legit.orders', silently redirecting bulk writes into the 'admin' collection of the 'legit' database - or into an entirely different database depending on separator placement. … |
| Remediation | The primary fix is to upgrade go.mongodb.org/mongo-driver/v2 to v2.8.2 or later, which introduces proper escaping of reserved separator characters in the Client.BulkWrite namespace construction path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a code audit of all applications using the MongoDB Go Driver to identify where Client.BulkWrite receives user-supplied or untrusted input for database name parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today