CVE-2026-106430: MongoDB C++ Driver Information Disclosure

CVE-2026-106430 Overview

The MongoDB C++ Driver truncates field and collection names at embedded NUL bytes when those names are accepted by the collection API. This parsing mismatch causes the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by the application can redirect reads to an unintended field or trigger renames against an unintended collection. The operations execute under the application's existing database credentials, which can produce data integrity impact without any new authentication.

Critical Impact
Attackers with limited privileges can leverage name parsing inconsistencies to read unintended fields or rename unintended collections, resulting in data integrity loss across MongoDB deployments using the C++ Driver.

Affected Products

MongoDB C++ Driver (mongocxx) collection API consumers
Applications passing untrusted input into field names
Applications passing untrusted input into collection names

Discovery Timeline

2026-10-08 - CVE-2026-106430 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-106430

Vulnerability Analysis

The flaw is an interpretation conflict ([CWE-436]) between the MongoDB C++ Driver and the application that calls it. The driver accepts strings containing embedded NUL (\\x00) bytes in certain field and collection name parameters. During processing, the driver discards everything after the first NUL byte, while the calling application typically treats the same string as its full byte sequence.

An authenticated attacker who controls part of a name, for example a tenant identifier or a document field key, can craft input such as expected_name\\x00attacker_target. The application believes it is operating on expected_name\\x00attacker_target, but the driver issues the operation against expected_name. The resulting read, write, or rename operation uses the application's existing credentials and bypasses the application's own name validation.

Root Cause

The root cause is inconsistent handling of embedded NUL bytes between higher-level C++ string semantics (std::string, which permits embedded NULs) and the driver's downstream encoding of BSON keys and command parameters. The driver silently truncates rather than rejecting the input, violating the principle that any name validated by the application should be preserved verbatim.

Attack Vector

Exploitation requires network access to the application and valid low-privilege authentication to a code path that forwards a name into the collection API. The attacker injects a NUL byte into the controllable portion of the name. Two documented outcomes apply: reading distinct values from an unintended field, or renaming an unintended collection through the collection management API. Attack complexity is low once the injection sink is reached, and no user interaction is required.

No verified public exploit code is available. See MongoDB JIRA Issue CXX-3551 and MongoDB JIRA Issue CXX-3552 for upstream tracking.

Detection Methods for CVE-2026-106430

Indicators of Compromise

Application logs showing field or collection names containing embedded \\x00 bytes before being passed to mongocxx calls.
MongoDB server audit entries where executed collection or field names are shorter than the names recorded by application telemetry.
Unexpected renameCollection command events originating from application service accounts.
Reads returning values from fields the application never intended to query.

Detection Strategies

Instrument application code paths that call collection::rename, collection::find, and related APIs to log the raw byte length and content of name parameters.
Compare application-side name strings with MongoDB system.profile or audit log entries to identify truncation deltas.
Add input validators that reject any name parameter containing a NUL byte before invocation of the driver.

Monitoring Recommendations

Enable MongoDB auditing for renameCollection, drop, and create events and alert on unexpected source services.
Monitor for anomalous access patterns against sensitive collections tied to multi-tenant namespaces.
Correlate authentication telemetry with command execution to identify low-privilege accounts issuing name-sensitive operations.

How to Mitigate CVE-2026-106430

Immediate Actions Required

Inventory applications linking against the MongoDB C++ Driver and identify code paths that accept externally influenced field or collection names.
Add server-side validation that rejects any name parameter containing an embedded NUL byte before it reaches the driver.
Restrict database roles so application credentials cannot rename or access collections outside their intended scope.
Review recent MongoDB audit logs for unexpected renameCollection operations and anomalous field reads.

Patch Information

Refer to the upstream tracking tickets MongoDB JIRA Issue CXX-3551 and MongoDB JIRA Issue CXX-3552 for fixed driver versions and release notes. Upgrade all applications to the patched mongocxx release and rebuild dependent binaries.

Workarounds

Enforce an application-level denylist for the \\x00 character in any string destined for a field or collection name parameter.
Normalize and canonicalize names through a central helper function before passing them to the driver.
Apply least-privilege MongoDB roles that limit the scope of collections an authenticated user can affect.

bash

# Example input validation guard before invoking mongocxx APIs
if [[ "$COLLECTION_NAME" == *$'\\x00'* ]]; then
  echo "Rejecting name with embedded NUL byte" >&2
  exit 1
fi