Executive brief
MongoDB's C++ database driver fails to properly validate database and collection names supplied by applications, allowing special characters to redirect database operations to unintended targets. An attacker who can control the names passed to the driver (via untrusted application input) could read or write data from another tenant's database, potentially exposing sensitive information or modifying business records.
Technical details
The MongoDB C++ Driver has an input validation weakness in its handling of namespace identifiers (database and collection names). The driver fails to reject special characters, particularly "." (dot) and NUL bytes, which can be embedded in caller-supplied namespace strings. When an application constructs a namespace from untrusted input without additional validation, an attacker can inject these characters to cause the driver to silently reinterpret the intended database or collection and route operations to a different logical tenant's data. The fix, released in version 4.5.1, adds validation to reject "." in database names and NUL bytes in both database and collection names before transmission to the server.
Affected products
- MongoDB C++ Driver before 4.5.1
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fix released in version 4.5.1