Vulnerability in MongoDB C# Driver Affects Database Security

CVE-2026-114648

What is CVE-2026-114648?

The MongoDB C# Driver exhibits a critical flaw where it fails to properly neutralize dot and dollar characters in dictionary keys, field names, and array-filter identifiers utilized in LINQ queries. This oversight enables malicious input from an application user to manipulate the field paths sent to the server, thus redirecting queries or updates to unintended fields. As a result, sensitive user documents can be exposed, and updates may occur outside of the designated data scope. Additionally, certain inputs could create malformed fields, rendering stored documents inaccessible until repaired, posing significant risks to application integrity and user data.

References