CVE-2026-114647Medium· 4.3▾ SunlitThe MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field n…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.
c_driver >= 2.13.0 < 3.13.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114648High· 7.6NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
CVE-2026-114652Medium· 6.5Update operator injection via single-element list rewriting in the update builder
CVE-2026-114650Medium· 5.9Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
CVE-2026-114654Medium· 6.5BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
CVE-2026-114653Medium· 6.5Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
CVE-2026-114646Medium· 6.5NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire