---
id: CVE-2026-81523
title: >-
  A missing input-validation issue in MongoDB libmongocrypt's
  automatic-encryption context setup allows a caller-supplied database
  identifier to be accepted without sanitization
summary: >-
  A missing input-validation issue in MongoDB libmongocrypt's
  automatic-encryption context setup allows a caller-supplied database
  identifier to be accepted without sanitization. The resulting impact is
  limited to incorrect schema selectio…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-74
vendor: mongodb
product: libmongocrypt
affected:
  - libmongocrypt < 1.20.3
patched:
  - libmongocrypt 1.20.3
published: '2026-08-27'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T13:59:18.310'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81523'
references:
  - url: 'https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3'
    label: cna@mongodb.com
  - url: 'https://jira.mongodb.org/browse/MONGOCRYPT-977'
    label: cna@mongodb.com
tags:
  - nvd
epss: 0.00098
epssPercentile: 0.00715
ingestedAt: '2026-09-17T14:19:30.938Z'
---

## Overview

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

## Affected

- `libmongocrypt < 1.20.3`

## Remediation

Upgrade past the affected range:

- `libmongocrypt 1.20.3`