Executive brief
The MongoDB C Driver, a library used by applications to communicate with MongoDB databases, failed to properly validate database and collection names supplied by callers. An attacker who can control these names could bypass validation and direct database operations at unintended resources, potentially leading to unauthorized data access or modification.
Technical details
The MongoDB C Driver failed to sanitize caller-supplied database and collection name components, allowing special characters (specifically "." and NUL bytes) to pass through without validation. These characters can be reinterpreted by the driver's namespace encoding logic, causing operations to target different resources than intended. An application that incorporates untrusted input into database or collection names becomes vulnerable. The fix, released in version 2.5.1, validates database names against "." and both database and collection names against NUL bytes, returning errors when these characters are detected.
Affected products
- MongoDB C Driver before 2.5.1
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fixed in version 2.5.1