{"vulnerability": "CVE-2026-8152", "sightings": [{"uuid": "2285b494-f441-4841-a00c-8549d92009c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81526", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-3", "content": "", "creation_timestamp": "2026-08-28T12:45:55.559704Z"}, {"uuid": "8ad1a25e-2761-4a89-b60d-a361b75da557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81521", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-3", "content": "", "creation_timestamp": "2026-08-28T12:45:44.563752Z"}, {"uuid": "d40b306a-ae40-49bb-ba38-4a58e3522c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81522", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-3", "content": "", "creation_timestamp": "2026-08-28T12:45:46.906344Z"}, {"uuid": "5090e7d4-355a-404b-ba83-0dc4fa686d05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81525", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-3", "content": "", "creation_timestamp": "2026-08-28T12:45:52.315746Z"}, {"uuid": "46ba6cf9-8650-4e6e-a8bc-692e21c870c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81529", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-3", "content": "", "creation_timestamp": "2026-08-28T12:45:57.841319Z"}, {"uuid": "83083cd1-5604-4d8f-ad51-5333b89bb77e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8152", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116963870440766522", "content": "Unblu Spark suffers a CRITICAL open redirect (CVE-2026-8152) leading to DOM XSS in siteEmbeddedSetup=true config. Attacker can access cookies & APIs of host app. No patch yet \u2014 disable this config ASAP. https://radar.offseq.com/threat/cve-2026-8152-cwe-601-url-redirection-to-untrusted-site-open-redirect-in-unblu-inc-unblu-spark-7d13478f5c7eb4ac #OffSeq #XSS #Vulnerability #InfoSec", "creation_timestamp": "2026-07-22T13:30:28.107916Z"}, {"uuid": "e386659e-d12c-45b4-868c-850c39ab412f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8152", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mragmcqfdr2r", "content": "Unblu Spark CRITICAL vuln: CVE-2026-8152 enables DOM XSS via open redirect if siteEmbeddedSetup=true. No patch. Disable the config to reduce risk. \ud83d\udd12 https://radar.offseq.com/threat/cve-2026-8152-cwe-601-url-redirection-to-untrusted-site-open-redirect-in-unblu-inc-unblu-spark-7d13478f5c7eb4ac #Off...", "creation_timestamp": "2026-07-22T13:30:29.959638Z"}, {"uuid": "6a96b348-fe44-418c-81a1-901fc9387c48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8152", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mraj5uvyiy22", "content": "CVE-2026-8152 - unblu spark\nIf Unblu Spark is deployed in a certain way, an attacker can trick users into visiting a malicious website, which can then access sensitive information from the host application.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unbluspark #unblu #CVE #infosec", "creation_timestamp": "2026-07-22T14:16:06.019510Z"}, {"uuid": "f9a5405b-cc07-4239-8e30-b8242a8c14f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8152", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mral4esv3224", "content": "CVE-2026-8152 - Unblu Spark Open Redirect leading to DOM-Based XSS\nCVE ID : CVE-2026-8152\n \n Published : July 22, 2026, 1:16 p.m. | 29\u00a0minutes ago\n \n Description : Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XS...", "creation_timestamp": "2026-07-22T14:51:06.430539Z"}, {"uuid": "79ac5af9-5523-48b9-97d4-fe6958787e98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8152", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mramd2lkoz2e", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-8152](https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001)\nUnblu Spark conta...\nhttps://docs.unblu.com/latest/security-bulletins/#UBL-2026-001 #ZeroDay #PatchManagement #Vulnerability", "creation_timestamp": "2026-07-22T15:12:40.960763Z"}, {"uuid": "610860be-a42b-43c3-81ec-7ffc8dc85b36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81520", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu73uf3kgl22", "content": "\ud83d\udfe0 CVE-2026-81520 - High (7.5)\n\nA network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI aut...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-81520/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-29T05:01:05.157468Z"}, {"uuid": "b4798bfb-1043-45d3-911b-d3d9f89ab64b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81529", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mu4666u4nh2x", "content": "CVE-2026-81529 - Connection-option injection in MongoDB C# Driver allows security control bypass. CVSS 7.1. Audit code and sanitize inputs now. #CVE #MongoDB #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-81529/", "creation_timestamp": "2026-08-28T01:04:21.362027Z"}, {"uuid": "3797fad8-03d3-47ef-a16a-063e9a49446c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81529", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117170442136115970", "content": "CVE-2026-81529 - Connection-option injection in MongoDB C# Driver allows security control bypass. CVSS 7.1. Audit code and sanitize inputs now. #CVE #MongoDB #infosec\nhttps://www.valtersit.com/cve/CVE-2026-81529/", "creation_timestamp": "2026-08-28T01:04:21.907461Z"}, {"uuid": "950deda1-9924-4319-a003-130ea2c00eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81529", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mu4ar343qk2w", "content": "MongoDB Driver Bypass Turns Your Security Theater Into A Smoking Ruin\nPANIC 63% | Lag 0.0h | CVE-2026-81529 is a connection-option injection flaw in the MongoDB C# Driver that can bypass securi\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-28T01:50:42.363730Z"}, {"uuid": "f7ae363c-942f-4596-bdd8-74692792f5fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81525", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mu5ur4nnfl2a", "content": "Discover the details of recent MongoDB security vulnerabilities affecting drivers and BI connectors. Update your systems to patch CVE-2026-81525 and others.\n\n#MongoDB #Cybersecurity #Vulnerability #CVE202681525 #DatabaseSecurity", "creation_timestamp": "2026-08-28T17:21:19.188761Z"}, {"uuid": "1b1a4169-66e7-4554-9897-d352fea51540", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81525", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fdi7tx66oeqsz", "content": "CVE-2026-81525 - Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver\nCVE ID : CVE-2026-81525\n \n Published : Aug. 27, 2026, 8:18 p.m. | 16\u00a0minutes ago\n \n Description : The MongoDB client library for PHP does not sufficiently sanitize s...", "creation_timestamp": "2026-08-27T22:00:18.070963Z"}, {"uuid": "f0d36762-42fd-4850-9af8-e83c996b6430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81522", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hif4oqptdvrrt", "content": "CVE-2026-81522 - Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver\nCVE ID : CVE-2026-81522\n \n Published : Aug. 27, 2026, 8:18 p.m. | 16\u00a0minutes ago\n \n Description : A weakness in the MongoDB C++ Driver's handling of caller-supplied ...", "creation_timestamp": "2026-08-27T22:06:17.215836Z"}, {"uuid": "926dda25-5c21-4614-931a-2eefbd917b5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81525", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3xbkhsju2z", "content": "\ud83d\udfe0 CVE-2026-81525 - High (8.1)\n\nThe MongoDB client library for PHP does not sufficiently sanitize special elements in application...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-81525/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-27T23:00:58.589592Z"}, {"uuid": "1817e906-c021-46a0-b4a8-14b5d65c6e62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81522", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3xbdgkmj22", "content": "\ud83d\udfe0 CVE-2026-81522 - High (8.1)\n\nA weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows s...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-81522/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-27T23:00:51.440536Z"}, {"uuid": "aec650c4-f6f6-4a92-81c9-560be992621a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81520", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mua2is4qhj25", "content": "CVE-2026-81520 - DoS vulnerability in MongoDB Connector for BI allows unauthenticated resource exhaustion. CVSS 7.5. Restrict access immediately. #CVE #MongoDB #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-81520/", "creation_timestamp": "2026-08-29T14:09:21.328450Z"}, {"uuid": "ef0a5220-23d7-4a25-b33c-03e81f54a4d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81520", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117179191206375825", "content": "CVE-2026-81520 - DoS vulnerability in MongoDB Connector for BI allows unauthenticated resource exhaustion. CVSS 7.5. Restrict access immediately. #CVE #MongoDB #infosec\nhttps://www.valtersit.com/cve/CVE-2026-81520/", "creation_timestamp": "2026-08-29T14:09:28.098520Z"}, {"uuid": "9239e7cf-386e-4b82-8fb5-872e76a90ec3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81525", "type": "seen", "source": "https://gist.github.com/alon710/5fa9ee3aa8e2d98c87b91ce0095db96e", "content": "# CVE-2026-81525: CVE-2026-81525: Cross-Tenant Database Retargeting via Dot and Null Injection in MongoDB PHP Driver\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81525\n\n## Summary\nA high-severity namespace injection vulnerability in both the MongoDB Client Library for PHP (mongodb/mongodb) and the native PHP C Extension (ext-mongodb) allows unauthenticated remote attackers to bypass logical database separation and execute database commands inside unauthorized storage compartments via dot (\".\") and null byte (\"\\0\") injection.\n\n## TL;DR\nImproper input validation in MongoDB's PHP libraries allows attackers to inject dot characters and null bytes into database and collection name parameters, silently retargeting database queries and writes to administrative or system collections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-943: Improper Neutralization of Special Elements in Data Query Logic\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.6 (High)\n- **EPSS Score**: 0.00273 (19.38th Percentile)\n- **Impact**: Logical Security Boundary Bypass / Multi-Tenant Retargeting\n- **Exploit Status**: Proof-of-Concept (PoC) Released\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- MongoDB Client Library for PHP (mongodb/mongodb)\n- MongoDB PHP C Extension (ext-mongodb)\n- **mongodb/mongodb**: < 1.21.4 (Fixed in: `1.21.4`)\n- **mongodb/mongodb**: >= 2.0.0, < 2.4.1 (Fixed in: `2.4.1`)\n- **ext-mongodb**: < 1.21.6 (Fixed in: `1.21.6`)\n- **ext-mongodb**: >= 2.0.0, < 2.4.1 (Fixed in: `2.4.1`)\n\n## Mitigation\n\n- Upgrade MongoDB PHP Client Library to 1.21.4+ or 2.4.1+\n- Upgrade PHP C Extension (ext-mongodb) to 1.21.6+ or 2.4.1+\n- Validate and sanitize user-supplied database and collection identifiers using alphanumeric allowlists\n- Restrict application database user privileges to prevent access to administrative namespaces\n\n**Remediation Steps:**\n1. Identify any database queries where database or collection identifiers are dynamically constructed from client input\n2. Update Composer dependencies to pull mongodb/mongodb version 1.21.4 or 2.4.1\n3. Upgrade the native PECL extension using: pecl install mongodb-1.21.6 (or 2.4.1)\n4. Implement local input validation utilizing str_contains() or regular expressions to reject dots and null bytes on old versions\n\n## References\n\n- [MongoDB JIRA PHPLIB-1927](https://jira.mongodb.org/browse/PHPLIB-1927)\n- [MongoDB PHP Library 1.21.4 Release](https://github.com/mongodb/mongo-php-library/releases/tag/1.21.4)\n- [MongoDB PHP Library 2.4.1 Release](https://github.com/mongodb/mongo-php-library/releases/tag/2.4.1)\n- [MongoDB PHP Driver 1.21.6 Release](https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.6)\n- [MongoDB PHP Driver 2.4.1 Release](https://github.com/mongodb/mongo-php-driver/releases/tag/2.4.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81525) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T10:33:18.416562Z"}]}