MongoDB C++ Driver EUVD-2026-95155

Exploitation requires an authenticated actor (PR:L) holding valid database credentials, and the calling application must pass an attacker-influenced field or collection name to the MongoDB C++ Driver's collection API without rejecting embedded NUL bytes; the AT:P metric reflects that the attacker must be able to control such a name. It is limited to applications built on the affected C++ Driver that expose name input to a semi-trusted user, and the impact is scoped to the privileges of the application's existing database credentials (no privilege escalation beyond that context). It does not work against applications that sanitize or do not accept externally-influenced names, nor against other MongoDB language drivers.

This is a medium-severity (CVSS 4.0 base 6.0) interpretation-conflict flaw (CWE-436) in the MongoDB C++ Driver, best characterized as a real-but-bounded data-integrity/disclosure issue rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N) shows the strongest signal is integrity (VI:H - an unintended collection can be renamed), with only limited confidentiality (VC:L - reading an unintended field) and no availability impact. The AT:P (attack-requirements present) metric and PR:L both temper the risk: exploitation is not against arbitrary targets but requires an authenticated actor who can already influence a name the application passes to the collection API, using the application's existing credentials - so this is primarily a privilege/trust-boundary bypass within an already-authenticated context, not a pre-auth remote takeover. No EPSS score, KEV listing, or POC was provided in the input; absence of these is not evidence either way but means there is no public signal of active exploitation or weaponization. Net: treat as a prioritized patch for applications that pass externally-influenced names to the MongoDB C++ Driver, but it does not carry the automatable, widespread-exploitation profile of a critical bug. Note one input inconsistency: the Tags list 'C Driver' and 'Information Disclosure', yet the CPE (c++_driver), description, and JIRA references (CXX-*) all indicate the C++ Driver and the dominant impact is integrity, not disclosure - verify tagging against the vendor record.

An application using the affected MongoDB C++ Driver accepts a field or collection name derived from user-controllable input and passes it to the collection API. An authenticated user supplies a name containing an embedded NUL byte (e.g. 'reports\0secret'), causing the driver and application to disagree on the effective name, so the operation reads from an unintended field or renames an unintended collection using the app's own database credentials. No public exploit code was identified at time of analysis; realistic abuse requires the attacker to influence a name reaching the API (reflected by AT:P and PR:L).