MongoDB C# Driver Vulnerability Affecting User Input Validation

CVE-2026-81528

What is CVE-2026-81528?

The MongoDB C# driver has a vulnerability in its document-replacement code path where essential element-name/shape validation is absent. This allows untrusted input to be passed directly to the database, potentially leading to unintended execution of that input as database commands rather than treating it as mere data. Applications that pass loosely-typed input without proper validation risk exposing sensitive data or executing harmful operations under the application's credentials. Notably, applications utilizing strongly-typed document mappings are not influenced by this vulnerability.

References