The MongoDB C++ Driver contains a flaw in its treatment of caller‑supplied namespace identifiers. When special characters such as a dot or NUL byte are embedded in the identifier, the driver may interpret the string as targeting a different logical tenant. This means that, if an application constructs a namespace string from untrusted input without proper validation, the operation can be redirected to a tenant that the application was not intended to access, allowing limited unauthorized read or write of that tenant’s data.

MongoDB C++ Driver; any application using the driver that builds namespace identifiers from untrusted input. The CVE does not specify which driver releases are affected; a fix is referenced in the advisory for the release r4.5.1, indicating that earlier releases could be vulnerable.

The CVSS score of 8.6 classifies the vulnerability as high severity. The EPSS score is less than 1%, indicating a very low expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation has been reported. Attackers can exploit the flaw by injecting special characters into a namespace string supplied by an untrusted source. Since the flaw exists in the driver layer, the attacker only needs to supply a crafted namespace identifier; no elevated privileges or additional compromise are required, provided the application uses untrusted data to form database identifiers.