Data-query Logic Neutralization in MongoDB C# Driver

CVE-2026-114652

What is CVE-2026-114652?

A vulnerability in the MongoDB C# Driver allows application-defined values in update statements to be misinterpreted as query commands, risking unintended modifications or deletions of stored data. This issue can be exploited by an ordinary user with read-write access, leading to unauthorized alterations in application data integrity. Proper handling and sanitization of user input are critical to mitigate this risk, ensuring that user-provided data is treated as literal values and not as query logic. For more information on updates and fixes, refer to the MongoDB issue tracker and release notes.

References