CVE-2026-106430
Medium
Description
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.
SeverityMedium
CVSS5.9
Exploit probability—
Product
C++ Driver
PublishedOct 8, 2026
First seenOct 8, 2026
Weakness typeCWE-436CWE-436
How to fix
Update
- MongoDB C++ Driver4.6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MongoDB C++ Driver | 3.0.0 ≤ v < 4.6.1 | 4.6.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.