Is CVE-2026-81526 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81526 being exploited in the wild.

How severe is CVE-2026-81526?

Medium severity, with a CVSS score of 6.5, published 27 August 2026.

Which products and versions are affected?

MongoDB Rust Driver before 3.8.2.

Is there a fix for CVE-2026-81526?

A patch was published on 2026-08-27: v3.8.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81526 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81526?

Check whether you run MongoDB Rust Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81526: MongoDB Rust Driver injection in database/collection name

CVE-2026-81526 · Severity: medium · CVSS 6.5 · Published 2026-08-27

The MongoDB Rust Driver fails to validate database and collection names when processing write operations, allowing an attacker to redirect writes to unintended targets within the same MongoDB deployment. An application that accepts user input for database or collection identifiers could inadvertently write data belonging to one user or tenant into another, compromising data isolation and potentially violating regulatory compliance requirements.

Technologies: MongoDB Rust Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-81526 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81526 being exploited in the wild.
How severe is CVE-2026-81526?: Medium severity, with a CVSS score of 6.5, published 27 August 2026.
Which products and versions are affected?: MongoDB Rust Driver before 3.8.2.
Is there a fix for CVE-2026-81526?: A patch was published on 2026-08-27: v3.8.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81526 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81526?: Check whether you run MongoDB Rust Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a special character injection flaw in the MongoDB Rust Driver's Client::bulk_write operation. The driver does not neutralize or validate caller-supplied database and collection name arguments before embedding them in server requests, failing to reject special characters such as "." (dot) and NUL bytes. An attacker who can influence the target database or collection name in an application using the driver can craft a name that the server interprets differently, bypassing intended logical boundaries and causing write operations to be applied to an unintended database or collection with the application's own credentials. The fix validates database and collection names against these forbidden characters and returns an error if found. Patch version 3.8.2 is available.

Affected products

MongoDB Rust Driver before 3.8.2

Timeline

2026-08-27: disclosed
2026-08-27: patched: v3.8.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.