CVE-2026-81523

Name of the Vulnerable Software and Affected Versions MongoDB libmongocrypt (affected versions not specified)

Description A missing input-validation issue exists in the automatic-encryption context setup of MongoDB libmongocrypt. This flaw allows a caller-supplied database identifier to be accepted without proper sanitization, enabling cross-tenant database retargeting via dot or NUL injection in namespace strings. This can result in incorrect schema selection, potentially leading to the limited disclosure or modification of information handled by the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.