MongoDB C# Driver Regex Injection via LINQ Query Translation
CVE-2026-88026 Published on September 10, 2026
Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver
Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.
Vulnerability Analysis
CVE-2026-88026 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Improper Neutralization of Special Elements in Data Query Logic
The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Products Associated with CVE-2026-88026
Want to know whenever a new CVE is published for MongoDB C Driver? stack.watch will email you.
Affected Versions
MongoDB C# Driver:- Version 2.14.0, <= 3.11.1 is affected.