{"id":"CVE-2026-114647","title":"NoSQL operator injection via unvalidated replacement document in findOneAndReplace","summary":"The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field n…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-943"],"vendor":"MongoDB","product":"C# Driver","affected":["c_driver >= 2.13.0 < 3.13.0"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T21:25:33.454Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114647","references":[{"url":"https://jira.mongodb.org/browse/CSHARP-6186"},{"url":"https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0"},{"url":"https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-68cj-624m-mxj3"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T22:00:50.447Z","slug":"CVE-2026-114647","body":"## Overview\n\nThe MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.\n\n## Affected\n\n- `c_driver >= 2.13.0 < 3.13.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}