The vulnerability in the MongoDB Go Driver allows a caller to provide a database name that includes a reserved separator character (a dot) without proper escaping. The driver then uses that string to build the target namespace for a bulk write operation. The result is that writes intended for one database/collection may be directed elsewhere, potentially causing data corruption, accidental data loss, or unintended data exposure. The weakness is a form of improper input validation (CWE-99) and untrusted input misuse (CWE-791).

MongoDB Go Driver (referred to as the MongoDB Go Driver) is the only affected vendor/product. The issue is limited to the client-level BulkWrite API. No specific driver versions are listed, so any deployment using the driver that performs bulk writes is potentially exposed.

The CVSS score of 7.1 classifies this as a high‑severity vulnerability. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an application that accepts untrusted input as a database name, such as a multi‑tenant API endpoint or a user‑configurable database parameter. An attacker who can supply a crafted database name can cause the driver to write data to a different database/collection, thereby compromising data integrity and confidentiality without requiring any privileged access or additional components.