CVE-2026-81526 — MEDIUM (6.5)

Vulnerability Description

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Related Weaknesses (CWE)

CWE-74

References

FAQ

What is CVE-2026-81526?

CVE-2026-81526 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identif...

How severe is CVE-2026-81526?

CVE-2026-81526 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-81526?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.