CVE-2026-114648High· 7.6▾ TwilightThe MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user wh…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.
c_driver >= 2.14.0 < 3.13.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114647Medium· 4.3NoSQL operator injection via unvalidated replacement document in findOneAndReplace
CVE-2026-114652Medium· 6.5Update operator injection via single-element list rewriting in the update builder
CVE-2026-114650Medium· 5.9Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
CVE-2026-114654Medium· 6.5BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
CVE-2026-114653Medium· 6.5Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
CVE-2026-114646Medium· 6.5NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire