The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68334 advisory.

    Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused     management of edge devices and applications. It supports image-mode RHEL and     container workloads that run on Podman/Docker or Kubernetes.

    RHEM is now available as a standalone feature, providing greater flexibility for     edge deployments. In addition to the standalone version, RHEM continues to be     offered as a plugin for the following platforms:

    Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge     devices.
    Red Hat Ansible Automation Platform (AAP): Integrates edge management with     Ansible automation.

    This integration enables organizations to optimize the management and     orchestration of their fleets of edge devices; whether its thousands of     dispersed retail point-of-sale systems or industrial machinery on remote factory     floors.

    Value for customers and partners:

    * This solution not only helps customers manage thousands of devices but helps     scale operations.
    * To manage large-scale deployments, customers need to be able to integrate with     their existing management systems, support remote configuration and over-the-air     updates, and collect telemetry data for advanced analytics.
    * Red Hat Edge Manager offers a simple and security-focused lifecycle     management, from onboarding to decommissioning of edge devices.

    This complete end-to-end solution empowers organizations to gain the most value     from the fleets of devices that generate data, all from a centralized location.

    Security Fixes:

    * flightctl: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
    * flightctl: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
    * flightctl: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries     (CVE-2026-27145)
    * flightctl: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)
    * flightctl: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
    * flightctl: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
    * flightctl: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check     (CVE-2026-39831)
    * flightctl: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
    * flightctl: Moby container framework: Host file overwrite via race condition in docker cp mount setup     (CVE-2026-42306)
    * flightctl: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
    * flightctl: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
    * flightctl: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
    * flightctl: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs     (CVE-2026-46597)
    * flightctl: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints     (CVE-2026-48050)
    * flightctl: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
    * flightctl: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
    * flightctl: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
    * flightctl: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
    * flightctl: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
    * flightctl: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
    * flightctl: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)
    * flightctl: go-git: Arbitrary file read/write via symbolic link resolution (CVE-2026-71556)
    * flightctl: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite     (CVE-2026-81521)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name     containing a reserved separator character without escaping it before the name is used to build the target     namespace for the operation. An application that passes untrusted input as a database name could therefore     have the write directed at a database and collection other than the ones it intended. Only the     Client.BulkWrite API is affected. (CVE-2026-81521)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
346432	RHEL 10 / 9 : Red Hat Edge Manager Version 1.1.4 Security Update (Important) (RHSA-2026:68334)	Nessus	Red Hat Local Security Checks	Local	high
341273	Linux Distros Unpatched Vulnerability : CVE-2026-81521	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-81521

high

Tenable Plugins

high

high