CVE-2026-81522

Katalog CVE

CVSS 8.1 · High EPSS 0,46%

Kerentanan Improper Encoding or Escaping of Output pada mongodb c++ driver. Skor CVSS 3.1 8.1 (High) menurut mongodb.com.

Deskripsi (NVD)

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rekapitulasi Enam Kerentanan pada Driver MongoDB 19 Sep 2026

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/CXX-3552 advisory vendor
• https://github.com/mongodb/mongo-cxx-driver/releases/tag/r4.5.1 product