MongoDB C# Driver Connection-URL Delim Injection
CVE-2026-81529 Published on August 27, 2026

Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

NVD

Vulnerability Analysis

CVE-2026-81529 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
NONE

Weakness Type

What is an Argument Injection Vulnerability?

The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

CVE-2026-81529 has been classified to as an Argument Injection vulnerability or weakness.


Products Associated with CVE-2026-81529

Want to know whenever a new CVE is published for MongoDB C Driver? stack.watch will email you.

MongoDB C Driver
 

Affected Versions

MongoDB C# Driver: