MongoDB C# Driver: Unvalidated Replacement Allows MongoDB Query Injection
CVE-2026-81528 Published on August 27, 2026

NoSQL injection via array replacement bypassing update shape validation in driver write path
A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

NVD

Vulnerability Analysis

CVE-2026-81528 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Weakness Type

Improper Neutralization of Special Elements in Data Query Logic

The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.


Products Associated with CVE-2026-81528

Want to know whenever a new CVE is published for MongoDB C Driver? stack.watch will email you.

MongoDB C Driver
 

Affected Versions

MongoDB C# Driver: