MongoDB C Driver CVE-2026-81524

Exploitation requires that a calling application forwards untrusted, user-controlled strings directly to libmongoc as database name or collection name function arguments without prior input validation. The attacker must have a means to influence these string values - for example, through an API parameter, URL path segment, or form field that flows into a mongoc_collection_t or equivalent call. The CVSS 4.0 vector (PR:L) indicates that some form of low-privilege access or authenticated application interaction is required; fully unauthenticated, zero-touch exploitation is not supported. Exploitation is further limited by: the requirement for the specific vulnerable application code pattern, and the bounded impact (misdirected read or write to an alternative collection, not arbitrary code execution or full database takeover). Applications using only hardcoded, static database and collection names are not vulnerable regardless of version.

The CVSS 4.0 score of 5.3 (Medium) reflects a real but conditional risk: exploitation requires a specific application anti-pattern - passing unsanitized, caller-controlled strings directly as database or collection name arguments. PR:L confirms that some level of access or application interaction is required; unauthenticated mass exploitation is not supported by the available signals. No CISA KEV listing and no known POC further reduce urgency. EPSS data is absent from the provided intelligence. The confidentiality and integrity impact is limited (VC:L/VI:L in CVSS 4.0), meaning a successful exploitation yields access to or writes against unintended MongoDB collections, not full database or system compromise. Applications using hardcoded or internally generated collection and database names are entirely unexposed. The risk is most relevant to multi-tenant or user-facing applications where name components derive from external input.

An attacker submits a crafted string such as 'legit_db.shadow_collection' as a value that an application forwards to libmongoc as a database name argument. The driver composes the namespace using the injected '.' as a real separator, redirecting the operation to the 'shadow_collection' collection inside the 'legit_db' database rather than the intended target. No public POC is known at time of analysis.