CVE catalog

CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.24% · Oct 25, 2026

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-mongodb-mongo-driversid1.17.9+ds1-1vulnerable
Debiangolang-mongodb-mongo-driverforky1.17.9+ds1-1vulnerable
Debiangolang-mongodb-mongo-drivertrixie1.17.1+ds1-2vulnerable
Debiangolang-mongodb-mongo-driverbookworm1.8.4+ds1-3vulnerable
Cpego_driverNot reported2.8.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-mongodb-mongo-driversourcesid(unfixed)not yet assignedNot reported[1146711]
Debiangolang-mongodb-mongo-driversourceforky(unfixed)not yet assignedNot reported[1146711]
Debiangolang-mongodb-mongo-driversourcetrixie(unfixed)not yet assignedNot reported[1146711]
Debiangolang-mongodb-mongo-driversourcebookworm(unfixed)not yet assignedNot reported[1146711]
Cpego_drivercpeNot reported2.8.2Not reportedNVD-CVE-2026-81521Not reported

[Debian bug #1146711]

Notes

[trixie] golang-mongodb-mongo-driver: Minor issue [bookworm] golang-mongodb-mongo-driver: Limited support

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-mongodb-mongo-driver-dev]Affected

    Source package: [golang-mongodb-mongo-driver]

    Details (2)

    • 1.8.4+ds1-3 · all · bookworm

      Affected

      nvd · golang-mongodb-mongo-driver · debian · bookworm; nvd · golang-mongodb-mongo-driver · debian · 12

    • 1.8.4+ds1-3 · all · bookworm

      Affected

      nvd · golang-mongodb-mongo-driver · debian · bookworm; nvd · golang-mongodb-mongo-driver · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]