8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-81525

CVE-2026-81525: Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-81525

CVE-2026-81525:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mongodb/mongodb	composer	< 1.21.4	1.21.4
mongodb/mongodb	composer	>= 2.0.0, < 2.4.1	2.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the MongoDB PHP library did not properly validate database and collection names before using them to construct namespaces for database operations. Specifically, the library failed to reject names containing '.' (dot) and NUL bytes. An attacker could provide a specially crafted database or collection name (e.g., myDB.users) which, when concatenated with other parts of the namespace, would cause the MongoDB server to interpret the dot as a separator and perform the operation on a different collection (users) within a different database (myDB) than intended by the application logic. The patch addresses this by introducing a create_namespace helper function that validates the database and collection names, rejecting any that contain these malicious characters. This validation is now consistently applied across all relevant operation classes, including Collection, Database, BulkWrite, Delete, Find, InsertMany, InsertOne, RenameCollection, and Update.

Vulnerable functions

MongoDB\Collection::__construct

src/Collection.php

The constructor of the `Collection` class was vulnerable because it did not properly sanitize the `databaseName` and `collectionName` parameters. This allowed for the injection of special characters (like '.' and NUL bytes), which could lead to the operation being performed on an unintended database or collection.

MongoDB\Database::__construct

src/Database.php

The constructor of the `Database` class was vulnerable because it did not properly sanitize the `databaseName` parameter. This allowed for the injection of special characters (like '.' and NUL bytes), which could lead to the operation being performed on an unintended database.

MongoDB\Operation\BulkWrite::__construct

src/Operation/BulkWrite.php

The constructor for `BulkWrite` operations was vulnerable as it directly used the `databaseName` and `collectionName` to construct the namespace for the operation without validation. This could be exploited by passing malicious characters to target a different database or collection.

MongoDB\Operation\Delete::__construct

src/Operation/Delete.php

The constructor for `Delete` operations was vulnerable as it directly used the `databaseName` and `collectionName` to construct the namespace for the operation without validation. This could be exploited by passing malicious characters to target a different database or collection.

MongoDB\Operation\Find::__construct

src/Operation/Find.php

The constructor for `Find` operations was vulnerable as it directly used the `databaseName` and `collectionName` to construct the namespace for the operation without validation. This could be exploited by passing malicious characters to target a different database or collection.

MongoDB\Operation\InsertMany::__construct

src/Operation/InsertMany.php

The constructor for `InsertMany` operations was vulnerable as it directly used the `databaseName` and `collectionName` to construct the namespace for the operation without validation. This could be exploited by passing malicious characters to target a different database or collection.

MongoDB\Operation\InsertOne::__construct

src/Operation/InsertOne.php

The constructor for `InsertOne` operations was vulnerable as it directly used the `databaseName` and `collectionName` to construct the namespace for the operation without validation. This could be exploited by passing malicious characters to target a different database or collection.

MongoDB\Operation\RenameCollection::__construct

src/Operation/RenameCollection.php

The constructor for `RenameCollection` operations was vulnerable as it directly used the `fromDatabaseName`, `fromCollectionName`, `toDatabaseName`, and `toCollectionName` to construct the namespaces for the operation without validation. This could be exploited by passing malicious characters to target a different database or collection.

MongoDB\Operation\Update::__construct

src/Operation/Update.php

The constructor for `Update` operations was vulnerable as it directly used the `databaseName` and `collectionName` to construct the namespace for the operation without validation. This could be exploited by passing malicious characters to target a different database or collection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.