1. Home
  2. CVE Database
  3. CVE-2026-81523
MEDIUM · 4.4

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is...

Vulnerability Description

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

CVSS Score

4.4

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
MongodbLibmongocrypt< 1.20.3

Related Weaknesses (CWE)

CWE-74

References

FAQ

What is CVE-2026-81523?

CVE-2026-81523 is a vulnerability with a CVSS score of 4.4 (MEDIUM). A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is...

How severe is CVE-2026-81523?

CVE-2026-81523 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-81523?

Check the references section above for vendor advisories and patch information. Affected products include: Mongodb Libmongocrypt.