Do Son 
TL;DR
Recent disclosures highlight twelve MongoDB security vulnerabilities impacting various database drivers and the BI Connector. These flaws allow attackers to inject malicious database logic, redirect writes across tenants, and expose sensitive credentials. Organizations using MongoDB must upgrade their drivers and connectors immediately to mitigate these threats.
- Total: 12 CVEs
- Severity: 6 High · 6 Medium
- Actively exploited: None confirmed
- Highest severity: 8.6 (High · CVSSv4) — CVE-2026-81525
- Action: Apply the latest security updates now
Why the Vulnerabilities Matter
These MongoDB security vulnerabilities threaten data integrity and application confidentiality. Several of these flaws carry high CVSS scores, emphasizing their severity. For instance, CVE-2026-81525 in the PHP Driver scores an 8.6, enabling cross-tenant database retargeting. Consequently, attackers could silently direct operations to unintended storage locations. Additionally, CVE-2026-75159 scores an 8.2; unauthenticated attackers can terminate the mongosqld process, disrupting BI Connector availability. Although vendors have not released affected installation estimates, MongoDB’s widespread adoption means these flaws pose a massive risk. Currently, researchers have not confirmed active exploitation or published proof-of-concept exploits for these issues.
How the Attacks Work
These vulnerabilities exploit improper input validation and configuration handling across different components.
Driver Injection and Retargeting Flaws
In multiple drivers, inadequate sanitization allows attackers to manipulate namespace strings. For example, CVE-2026-81525 (PHP), CVE-2026-81524 (C), and CVE-2026-81522 (C++) involve cross-tenant database retargeting via dot/NUL injection. If an application incorporates untrusted text, the operation may target a different logical boundary. Similarly, CVE-2026-81526 affects the Rust driver, enabling unauthorized cross-database write redirection.
The C# driver suffers from several injection weaknesses. CVE-2026-81528 allows NoSQL injection by bypassing update shape validation during document replacement. Furthermore, CVE-2026-81529 allows connection-option injection because the connection-URL builder fails to neutralize delimiters.
Credential Exposure and Availability Issues
Other flaws expose sensitive information. CVE-2026-81530 affects the C# driver, exposing the KMS master key in plaintext diagnostic outputs. For the BI Connector, CVE-2026-75573 logs TLS private-key passwords in standard error when duplicate options exist. Meanwhile, CVE-2026-75159 crashes the BI Connector when a crafted Kerberos authentication exchange triggers an improper memory handling condition.
Affected Versions and Mitigation Steps
These MongoDB security vulnerabilities affect multiple driver ecosystems and versions:
- C# Driver: Versions 2.10.0 through 3.11.0.
- Rust Driver: Versions 3.0.0 through 3.8.1.
- PHP Library/Extension: Versions prior to 1.21.4 (Library) and 1.21.6 (Extension). Also affects 2.0.0 through 2.4.0.
- C Driver: Versions 1.0.0 through 2.5.0.
- C++ Driver: Versions 3.0.0 through 4.5.0.
- Go Driver: Versions 2.1.0 through 2.8.1.
- BI Connector: Versions 2.4.0 (and 2.12.0) through 2.14.29.
Administrators must update their respective drivers and connectors to the patched versions immediately. Furthermore, developers should enforce strict input validation and strongly-typed document mappings in their applications. For the complete list of affected versions and update instructions, please consult the official MongoDB security advisories.
