MongoDB Go Driver CVE-2026-81521

Exploitation requires three concurrent conditions: (1) the application uses the Client.BulkWrite API from go.mongodb.org/mongo-driver/v2 specifically - single-collection write APIs are not affected; (2) the application passes a caller-supplied or otherwise untrusted string as the database name argument without prior sanitization; and (3) the attacker has the ability to influence that database name input, typically through an API parameter, configuration endpoint, or multi-tenant identifier field. Applications that construct database names exclusively from static server-side configuration or validated allow-lists are not exploitable. Authentication requirements reflect the consuming application's access controls rather than the driver itself; the CVSS PR:L indicates that some level of application-layer access (e.g., authenticated API user) is typically required to reach the vulnerable code path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1, reflecting high integrity impact reachable over the network with low privilege. EPSS data is not provided in the input, so probabilistic exploitation likelihood cannot be cited. There is no CISA KEV entry and no known POC, meaningfully reducing near-term real-world risk despite the elevated CVSS score. The practical risk is conditional: exploitation requires an application to (a) use the Client.BulkWrite API specifically, (b) pass unsanitized user-controlled input as the database name, and (c) be exposed to untrusted callers. Applications that construct database names solely from server-side configuration or trusted sources are not affected. This is a library-level flaw; the true blast radius depends entirely on how consuming applications handle input - a common pattern in resource injection vulnerabilities. PR:L in the vector is accurate: the attacker must have a foothold in the consuming application's input layer, not the driver itself.

An attacker interacts with a Go web service that exposes a multi-tenant API where the database name is derived from a user-supplied tenant identifier. By supplying a tenant name such as 'legit.admin', the attacker causes the MongoDB Go Driver's Client.BulkWrite to construct the namespace 'legit.admin.orders' instead of 'legit.orders', silently redirecting bulk writes into the 'admin' collection of the 'legit' database - or into an entirely different database depending on separator placement. No public exploit code is known at this time.