Connection-Option Injection Vulnerability in MongoDB C# Driver

CVE-2026-81529

What is CVE-2026-81529?

The MongoDB C# Driver is susceptible to a connection-option injection vulnerability due to improper handling of delimiters in the construction of connection URLs. This flaw allows attackers to inject malicious connection options by supplying untrusted text, which is then serialized without adequate sanitization. As a result, a low-privileged user can manipulate security-related connection settings, potentially leading to unauthorized access or alteration of data. Developers must ensure that any user input passed to the URL builder is properly validated and sanitized to mitigate this risk.

References