A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

A vulnerability exists in the MongoDB C++ Driver related to improper handling of caller-supplied namespace identifiers. The flaw allows special characters to be embedded in namespace identifiers without adequate validation. Applications that construct namespace identifiers from untrusted input are susceptible to having their operations redirected to unintended targets. This can lead to limited unauthorized read and write access to data belonging to other logical tenants of the affected application. The issue is a form of namespace injection or tenant isolation bypass. The vulnerability is tracked as CVE-2026-81522 and has been addressed in the MongoDB C++ Driver release r4.5.1. Applications using the driver with multi-tenant architectures are at heightened risk if they do not validate user-supplied input before constructing namespace identifiers.