Description
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
Published: 2026-08-27
Score: 2 Low
EPSS: < 1% Very Low
KEV: No
Impact: Limited Data Disclosure
Action: Patch Update
AI Analysis

Impact

A missing input‑validation flaw in MongoDB’s libmongocrypt allows a caller to supply a database identifier containing dot or NUL characters without sanitization. The flaw occurs during automatic‑encryption context setup and results in an incorrect schema being selected. This can lead to limited disclosure or modification of the information handled by the application. The weakness is a classic CWE-74 "Improper Neutralization of Special Elements used in a Command (Command Injection)" scenario.

Affected Systems

MongoDB’s libmongocrypt component is affected. The issue has been addressed in the 1.20.3 release, though explicit version ranges impacted are not listed in the available data.

Risk and Exploitability

The vulnerability carries a CVSS score of 2, indicating low severity. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitability appears to require the ability to supply a database identifier to libmongocrypt, implying an attacker must already be able to execute code in the application’s context or supply malicious configuration. The impact is limited to incorrect schema use rather than full system compromise.

Generated by OpenCVE AI on August 28, 2026 at 08:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libmongocrypt to version 1.20.3 or later to apply the vendor fix.
  • Validate any database identifiers supplied to the application to ensure they contain only permitted characters and reject dot or NUL characters before passing them to libmongocrypt.
  • Review automatic encryption context configuration to confirm that only approved schema names are used, and remove any logic that allows arbitrary database names to be forwarded to the cryptographic library.

Generated by OpenCVE AI on August 28, 2026 at 08:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb libmongocrypt
Vendors & Products Mongodb
Mongodb libmongocrypt

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
Title Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
Weaknesses CWE-74
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mongodb Libmongocrypt
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-08-28T15:51:12.001Z

Reserved: 2026-08-26T22:13:50.099Z

Link: CVE-2026-81523

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-27T20:18:50.633

Modified: 2026-08-28T21:16:15.740

Link: CVE-2026-81523

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T10:45:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')