Which versions of Rust Driver are affected by EUVD-2026-67210?

MongoDB Rust Driver versions prior to 3.8.2 are vulnerable to authenticated injection attacks that redirect database write operations to unintended databases, with no public exploit identified at…. A patch is available.

How to fix or mitigate EUVD-2026-67210?

Within 24 hours, inventory all applications using the mongodb Rust crate in versions prior to 3.8.2 by scanning build configurations and dependency manifests. Within 7 days, upgrade mongodb crate to version 3.8.2 or later across all affected applications and validate functionality in staging environments. Within 30 days, complete production deployment of patched versions and perform final verification that all services are running mongodb crate 3.8.2 or later.

Rust Driver EUVD-2026-67210

Q: What is the CVSS score of EUVD-2026-67210?

EUVD-2026-67210 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-81526 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-27 mongodb

Authentication Bypass Rust Driver

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 27, 2026 - 22:03 EUVD

Source Code Evidence Fetched

Aug 27, 2026 - 20:45 vuln.today

Analysis Generated

Aug 27, 2026 - 20:45 vuln.today

CVE Published

Aug 27, 2026 - 18:32 cve.org

HIGH 7.1

DescriptionCVE.org

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

AnalysisAI

Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all applications using the mongodb Rust crate in versions prior to 3.8.2 by scanning build configurations and dependency manifests. …

Threat intelligence, references, and detailed analysis are available after sign-in.