{
  "cveId": "CVE-2026-81521",
  "url": "https://patchblox.com/security/cve/CVE-2026-81521",
  "summary": "CVE-2026-81521 is fixed in 2 products on 1 platform, first by RHSA-2026:68334, released September 17, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "flightctl: The MongoDB Go Driver\u0027s client-level bulk write operation may accept a caller-supplied database name containing a res...",
  "description": "The MongoDB Go Driver\u0027s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.",
  "published": "2026-08-27T18:31:45Z",
  "severity": "important",
  "cvss": 7.5,
  "epss": 0.00236,
  "epssPercentile": 0.1461,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "alloy",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.19.2-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22032-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22032-1",
      "released": "2026-10-06T13:15:27Z"
    },
    {
      "platform": "linux",
      "product": "alloy",
      "release": "sles 15.7",
      "fixedVersion": "1.19.2-150700.15.29.1",
      "fix": "SUSE-SU-2026:4408-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4408-1",
      "released": "2026-10-01T07:07:12Z"
    },
    {
      "platform": "linux",
      "product": "alloy",
      "release": "sles 16.0",
      "fixedVersion": "1.19.2-160000.1.1",
      "fix": "SUSE-SU-2026:24148-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24148-1",
      "released": "2026-10-06T13:07:44Z"
    },
    {
      "platform": "linux",
      "product": "flightctl",
      "release": "RHEL 10",
      "fixedVersion": "1.1.4-1.el10em",
      "fix": "RHSA-2026:68334",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-68334",
      "released": "2026-09-17T18:11:06Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}