CVE-2026-81521 - The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected. - 漏洞详情

漏洞编号：CVE-2026-81521

风险等级：中危

漏洞来源：CVE

CVE 编号：CVE-2026-81521

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-99

发布/更新时间：2026-08-27 / 2026-08-28

漏洞描述

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

漏洞描述

相关链接

相关漏洞