Skip to main content

libmongocrypt CVE-2026-81523

| EUVDEUVD-2026-67207 LOW
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2026-08-27 mongodb
Information Disclosure Libmongocrypt
2.0
CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY
2.0 LOW
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.4 MEDIUM

Local vector (AV:L) and low privileges (PR:L) required to supply crafted namespace; limited confidentiality and integrity impact only; no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 27, 2026 - 22:03 EUVD
Source Code Evidence Fetched
Aug 27, 2026 - 20:54 vuln.today
Analysis Generated
Aug 27, 2026 - 20:54 vuln.today

DescriptionCVE.org

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

AnalysisAI

Input injection in MongoDB libmongocrypt's automatic-encryption context setup permits caller-supplied database and collection name arguments containing '.' or NUL bytes to pass without sanitization, causing incorrect schema selection during Client-Side Field Level Encryption (CSFLE) operations. Affected callers - those with local access and low privileges - may obtain limited unauthorized disclosure or modification of data processed under the wrong encryption schema. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Control caller-supplied namespace input
Delivery
Supply '.' or NUL byte in database name
Exploit
Bypass libmongocrypt input validation
Execution
Trigger incorrect schema selection
Persist
Access data under wrong encryption policy
Impact
Limited disclosure or modification
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) the target application must have MongoDB Client-Side Field Level Encryption (CSFLE) configured with automatic encryption enabled - this is a non-default, explicitly configured feature; (2) the attacker must have local access and low privileges sufficient to influence the database or collection name argument passed to the libmongocrypt automatic-encryption context (AV:L, PR:L from the CVSS 4.0 vector); (3) specific attack prerequisites must be satisfied (AT:P), meaning the attacker cannot trivially reach the vulnerable code path without controlling an input at the application or driver API layer. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The risk signals are uniformly low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged caller - such as a compromised microservice or a malicious internal application component - supplies a crafted database name containing '.' or a NUL byte to the libmongocrypt automatic-encryption context setup API. The unsanitized input causes the library to resolve the wrong namespace, selecting an unintended encryption schema for the operation. …
Remediation Upgrade libmongocrypt to version 1.20.3, which validates database and collection name arguments against '.' and NUL bytes per the fix documented at https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libmongocrypt

View all
CVE-2021-20327 MEDIUM
6.8 Feb 25

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-81523 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy