Executive brief
MongoDB's libmongocrypt library, used to secure sensitive data in applications, fails to validate database identifiers supplied during automatic encryption setup. An attacker or misconfigured application could provide a crafted database name that bypasses validation, leading to incorrect encryption schema selection and potential unauthorized access or modification of encrypted application data.
Technical details
A missing input-validation vulnerability exists in MongoDB libmongocrypt's automatic-encryption context initialization. The library accepts caller-supplied database identifiers without sanitization, specifically failing to reject database names containing dots (.) or embedded NUL bytes. This allows an attacker to specify an invalid database name that causes the library to select an incorrect encryption schema, potentially leading to data encrypted with the wrong key or schema. The vulnerability is exploitable by any code that calls the affected libmongocrypt API with untrusted database identifier input. MongoDB released patches in versions 1.20.3 and 1.21.0 that validate database and collection names against prohibited characters.
Affected products
- MongoDB libmongocrypt prior to 1.20.3 and 1.21.0
Timeline
- 2026-08-27: disclosed: CVE-2026-81523 published
- 2026-08-27: patched: Fixed in libmongocrypt 1.20.3 and 1.21.0