CVE-2026-81523
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
Risk Assessment
This may lead to incorrect data processing, potentially resulting in limited disclosure or modification of information handled by the application.
Recommendation
Upgrade MongoDB libmongocrypt to a patched version. Validate user-supplied database identifiers before use.
Other vulnerabilities in MongoDB libmongocrypt
See all- CVE-2026-106434Medium
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.
- CVE-2026-106429Medium
An integer underflow in MongoDB libmongocrypt's KMS endpoint-parsing logic can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.
Original NVD description (English source)
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS