Hi Guillem,

The following vulnerability was published for golang-mongodb-mongo-driver.

I'm though not completely sure if the issue is only introduce with the
improved bulk Write API in v2.1.0,
50cf0c20d228975074c0010bfb688917e25934a4 or was present before. Can
you please confirm?

CVE-2026-81521[0]:
| The MongoDB Go Driver's client-level bulk write operation may accept
| a caller-supplied database name containing a reserved separator
| character without escaping it before the name is used to build the
| target namespace for the operation. An application that passes
| untrusted input as a database name could therefore have the write
| directed at a database and collection other than the ones it
| intended. Only the Client.BulkWrite API is affected.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-81521
https://www.cve.org/CVERecord?id=CVE-2026-81521

Please adjust the affected versions in the BTS as needed. In fact if
the hypotetis is true that is only introduced with the rewrite of the
Bulk Write API then we can close this bug.

Regards,
Salvatore