CVE-2026-81521: MongoDB Go Driver

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

Affected products

• MongoDB Go Driver: from 2.1.0, before 2.8.2 (fixed in 2.8.2)

Published 2026-08-27. Last modified 2026-10-06.