EUVD-2026-67208Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable application accepts user input as name components (AV:N, PR:L); impact is limited to misdirected read/write with no scope change or availability loss.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.
AnalysisAI
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing a '.' separator or NUL byte to redirect a MongoDB operation to an unintended resource. Applications that incorporate unsanitized user input into these name components are affected across all libmongoc versions prior to 2.5.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a calling application forwards untrusted, user-controlled strings directly to libmongoc as database name or collection name function arguments without prior input validation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) reflects a real but conditional risk: exploitation requires a specific application anti-pattern - passing unsanitized, caller-controlled strings directly as database or collection name arguments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted string such as 'legit_db.shadow_collection' as a value that an application forwards to libmongoc as a database name argument. The driver composes the namespace using the injected '.' as a real separator, redirecting the operation to the 'shadow_collection' collection inside the 'legit_db' database rather than the intended target. … |
| Remediation | Upgrade libmongoc to version 2.5.1 or later, which validates database and collection name arguments against '.' and NUL bytes at the driver level (https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabli
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rate
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation,
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged atta
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a co
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vu
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today