Data Validation Vulnerability in MongoDB C# Driver

CVE-2026-114646

What is CVE-2026-114646?

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver, where the driver does not verify the size of externally supplied binary data. This oversight allows unauthenticated users to manipulate the database commands without requiring any database credentials of their own. As a result, malicious actors can insert additional elements or remove existing elements from stored data, leading to unauthorized data modifications and potential disclosure of sensitive information.

References