Document Modification Issue in MongoDB C# Driver by MongoDB

CVE-2026-114647

What is CVE-2026-114647?

The MongoDB C# Driver allows for unintended document modifications by failing to reject replacement documents with top-level field names that start with a dollar sign. This can lead to the application applying update operators instead of executing a full document replacement. If an application constructs such documents from user input, it risks altering database records in ways the developer did not foresee. This presents a potential attack vector where an adversary could exploit the vulnerability by influencing input data.

References