Skip to content
Fencer Intel
medium 6.5

CVE-2026-81521 json

Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

published 2mo ago modified last mo. also EUVD-2026-67205

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

Patch / fix

  • MongoDB GO Driver 2.8.2, 2.9.2
  • flightctl edge manager 1.1 1.1.4-1.el10em
  • flightctl edge manager 1.1 1.1.4-1.el9em
  • flightctl-cli edge manager 1.1 1.1.4-1.el10em
  • flightctl-cli edge manager 1.1 1.1.4-1.el9em
  • flightctl-agent edge manager 1.1 1.1.4-1.el10em
  • flightctl-agent edge manager 1.1 1.1.4-1.el9em

red hat advisories RHSA-2026:68334

  • alloy SLES for SAP applications 16.0, SLES 16.0 1.19.2-160000.1.1
  • alloy SLE Module for Basesystem 15 SP7 1.19.2-150700.15.29.1

suse advisories SUSE-SU-2026:24148-1SUSE-SU-2026:4408-1

  • alloy openSUSE Leap 16.0 1.19.2-160000.1.1
  • alloy openSUSE Tumbleweed 1.19.2-1.1

opensuse advisories openSUSE-SU-2026:22032-1openSUSE-SU-2026:11803-1

Is CVE-2026-81521 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-81521 updated cvss 7.5

go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines-client 1.22.0-11814.el9, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-chains-controller-rhel8, openshift-pipelines/pipelines-chains-controller-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift GitOps microshift-gitops 1.19.2-36.el9, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/must-gather-rhel9, openshift-gitops-argocd-cli 1.19.2-36.el9 Red Hat Trusted Artifact Signer rhtas/gitsign-rhel9, rhtas/rekor-cli-rhel9, rhtas/rekor-server-rhel9, rhtas/rekor-backfill-redis-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Edge Manager 1.1 rhem/flightctl-api-rhel9 1789487080, rhem/flightctl-api-rhel10 1789485939, rhem/flightctl-worker-rhel9 1789486829, rhem/flightctl-worker-rhel10 1789486071, rhem/flightctl-db-setup-rhel9 1789487116, rhem/flightctl-periodic-rhel9 1789486513, +18 more
    fixed: vendor fix RHSA-2026:68044
  • Red Hat Edge Manager 1.2 rhem/flightctl-api-rhel9 1789485317, rhem/flightctl-api-rhel10 1789485653, rhem/flightctl-worker-rhel9 1789488061, rhem/flightctl-worker-rhel10 1789486740, rhem/flightctl-db-setup-rhel9 1789485698, rhem/flightctl-periodic-rhel9 1789485282, +18 more
    fixed: vendor fix RHSA-2026:68006
  • Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift Dev Spaces 3.31 devspaces/udi-rhel9 1792708612
    fixed: vendor fix RHSA-2026:90321
  • Red Hat RHEM 1.1 for RHEL 9 flightctl 1.1.4-1.el9em, flightctl-cli 1.1.4-1.el9em, flightctl-agent 1.1.4-1.el9em Red Hat RHEM 1.1 for RHEL 10 flightctl 1.1.4-1.el10em, flightctl-cli 1.1.4-1.el10em, flightctl-agent 1.1.4-1.el10em
    fixed: vendor fix RHSA-2026:68334
  • Red Hat Edge Manager 1.1 rhem/flightctl-ui-rhel10 1789486181, rhem/flightctl-ui-ocp-rhel9 1789486446, rhem/flightctl-ui-ocp-rhel10 1789486226 Red Hat Edge Manager 1.2 rhem/flightctl-ui-rhel9 1789486750, rhem/flightctl-ui-rhel10 1789488111, rhem/flightctl-ui-ocp-rhel9 1789486476, rhem/flightctl-ui-ocp-rhel10 1789485920 Red Hat OpenShift AI 3.4 rhoai/odh-automl-rhel9 1791535789, rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, rhoai/odh-eval-hub-rhel9 1791852583, rhoai/odh-maas-api-rhel9 1791788707, +98 more Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9 Red Hat OpenShift Dev Spaces 3.31 devspaces/code-rhel9 1792599388, devspaces/server-rhel9 1792775639, devspaces/openvsx-rhel9 1792494821, devspaces/traefik-rhel9 1792464177, devspaces/udi-base-rhel9 1792686842, devspaces/code-sshd-rhel9 1792598059, +9 more Red Hat Trusted Artifact Signer rhtas/policy-controller-rhel9
    +2 more products
    Red Hat RHEM 1.1 for RHEL 9 flightctl-selinux 1.1.4-1.el9em, flightctl-services 1.1.4-1.el9em, flightctl-observability 1.1.4-1.el9em Red Hat RHEM 1.1 for RHEL 10 flightctl-selinux 1.1.4-1.el10em, flightctl-services 1.1.4-1.el10em, flightctl-observability 1.1.4-1.el10em
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2mo ago

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • MongoDB GO Driver

Classification

Weakness
  • CWE-99 Improper Control of Resource Identifiers

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.