CVE-2026-106430
Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.
| CWE | CWE-436 |
| Vendor | mongodb |
| Product | c++ driver |
| Ecosystems | |
| Industries | Technology |
| Published | Oct 8, 2026 |
| Last Updated | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb c++ driver
Be the first to know when new medium vulnerabilities affecting mongodb c++ driver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
None
Affected Versions
MongoDB / C++ Driver
3.0.0 < 4.6.1