---
id: CVE-2026-114647
title: >-
  NoSQL operator injection via unvalidated replacement document in
  findOneAndReplace
summary: >-
  The MongoDB C# Driver does not reject replacement documents whose top-level
  field names begin with a dollar sign in FindOneAndReplace, unlike other
  replace operations. An application that builds such a document from
  user-supplied field n…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-943
vendor: MongoDB
product: C# Driver
affected:
  - c_driver >= 2.13.0 < 3.13.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T21:25:33.454Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114647'
references:
  - url: 'https://jira.mongodb.org/browse/CSHARP-6186'
  - url: 'https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0'
  - url: >-
      https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-68cj-624m-mxj3
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.447Z'
---

## Overview

The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.

## Affected

- `c_driver >= 2.13.0 < 3.13.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.