CVE-2026-106430: falha de média gravidade em MongoDB C++ Driver
Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6epss 0.2%
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · C++ DriverCVEs relacionadas — MongoDB C++ Driver
No mesmo produto, das mais perigosas para as menos.
CVE-2026-81522HIGHCross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ DriverEPSS 0.5%CVE-2026-88034MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ DriverEPSS 0.5%CVE-2026-84966MEDIUMBSON element injection via NUL-embedded document keys in builder appendEPSS 0.1%CVE-2026-84970MEDIUMHeap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parserEPSS 0.1%