CVE-2026-81521

score

0.2

cvss

6.5

epss

0.2%

published

2026-08-27

kev added

—

first seen

2026-10-21

MongoDB Go Driver contains a broken access control vulnerability caused by improper escaping of caller-supplied database names with reserved separator characters in Client.BulkWrite API, letting attackers redirect writes to unintended databases and collections, exploit requires untrusted input as database name.