A weakness in the MongoDB C Driver allows special elements in database and collection name components to bypass sanitization when the driver composes the target namespace for an operation. The flaw permits an attacker to inject dot or NUL characters into these names, causing the driver to direct database operations to a namespace different from the one intended. This can enable an application that receives untrusted input to perform actions on another tenant’s data or databases, leading to confidentiality violations.

The vulnerability affects the MongoDB C Driver. No specific affected driver version is listed in the CNA data; however, the publicly referenced release tag 2.5.1 indicates that updates beyond this version include a fix.

The CVSS score of 5.3 places the issue in the Moderate range. The EPSS score is not available, so the exploited volume remains uncertain, and the KEV catalog lists it as not exploited. Nevertheless, the attack likely requires only the ability to supply arbitrary database or collection names in the client, which is common in many applications. Because the flaw directly allows cross‑tenant data access, the potential impact is significant, especially in multi‑tenant deployments. The overall risk is moderate but warrants timely remediation.