CVE-2026-81521
CVE
Medium
· CVSS 6.5
False PositiveMongoDB Go Driver: Write Redirection via Unescaped Database Name in Client Bulk Write
This advisory does not affect KrakenD
The MongoDB Go Driver is only present in KrakenD as a transitive dependency of a
third-party library, and only its BSON encoding packages are compiled in. The MongoDB
client, including the client-level bulk write API, is not part of the KrakenD binary.
KrakenD does not connect to MongoDB.
Component
MongoDB Go Driver
Disclosed
Nov 4, 2026
CVSS Score
6.5
Description
The
Client.BulkWrite operation of the MongoDB Go Driver accepts a caller-supplied
database name containing a reserved separator character without escaping it before
building the target namespace. An application that passes untrusted input as a
database name could have the write directed at a database and collection other than
the intended ones. This does not affect KrakenD.