Description

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T20:18:50.350Z",
  "pubdate": "2026-08-27T20:18:50.350Z",
  "executiveSummary": "The MongoDB Go Driver is susceptible to a namespace injection vulnerability within the Client.BulkWrite API. This flaw arises from the improper handling of user-supplied database names that contain reserved separator characters. By failing to sanitize or escape these inputs, the driver allows a caller to inadvertently or maliciously manipulate the target namespace of a bulk write operation.\nThe primary impact of this vulnerability is unauthorized data routing, where write operations are redirected to unintended databases and collections. This poses a significant risk to data integrity and logical isolation within a multi-tenant or sensitive application environment. An attacker capable of influencing the database name parameter can divert write operations to arbitrary targets, potentially overwriting existing data or injecting information into restricted system namespaces. The vulnerability does not require authentication to the database itself, but relies on the application's exposure to untrusted input provided by an external actor that is subsequently passed into the affected function.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization of the database name string passed to the Client.BulkWrite function in the MongoDB Go Driver. In MongoDB, the namespace is defined as a concatenation of the database name and the collection name, separated by a period (e.g., 'database.collection').\nWhen the Client.BulkWrite method processes a user-supplied database name, it fails to inspect the input for the presence of the '.' character. Because the driver constructs the target namespace by concatenating the provided database name and collection name without escaping or validating the delimiter, an attacker can supply a crafted database name containing a period to shift the boundary of the target namespace.\nFor example, if an application expects the database name 'user_data' and allows a user to specify the input, an attacker providing 'prod_db.admin' would cause the driver to construct a namespace targeting the 'admin' collection within the 'prod_db' database, rather than the intended 'user_data.admin' path. This effectively allows an attacker to perform unauthorized writes across database boundaries.\nThe attack flow is as follows: 1) The attacker identifies an application endpoint that accepts input used to construct the database name for a BulkWrite operation. 2) The attacker submits a malicious string containing a reserved dot character (e.g., 'target_db.collection_name'). 3) The MongoDB Go Driver receives this input and concatenates it with the collection specification. 4) The driver resolves the resulting string as a new namespace target due to the unescaped separator character. 5) The bulk write operation is executed against the attacker-specified database and collection.\nThis vulnerability is localized exclusively to the Client.BulkWrite API. The impact is significant as it facilitates unauthorized modification of data in databases that the application component was not intended to access. Post-exploitation, an attacker could manipulate application state, corrupt configuration data, or perform unauthorized data injection into arbitrary collections, depending on the privileges assigned to the database user utilized by the application."
}