Executive brief
The MongoDB Rust Driver fails to validate database and collection names when processing write operations, allowing an attacker to redirect writes to unintended targets within the same MongoDB deployment. An application that accepts user input for database or collection identifiers could inadvertently write data belonging to one user or tenant into another, compromising data isolation and potentially violating regulatory compliance requirements.
Technical details
The vulnerability is a special character injection flaw in the MongoDB Rust Driver's Client::bulk_write operation. The driver does not neutralize or validate caller-supplied database and collection name arguments before embedding them in server requests, failing to reject special characters such as "." (dot) and NUL bytes. An attacker who can influence the target database or collection name in an application using the driver can craft a name that the server interprets differently, bypassing intended logical boundaries and causing write operations to be applied to an unintended database or collection with the application's own credentials. The fix validates database and collection names against these forbidden characters and returns an error if found. Patch version 3.8.2 is available.
Affected products
- MongoDB Rust Driver before 3.8.2
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: v3.8.2 released