CVE-2026-81528

Awaiting Analysis Awaiting Analysis - Queue

MongoDB C# Driver Document Replacement Injection

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-28

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81528

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb.driver	3.11.1
mongodb	mongodb_csharp_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

This vulnerability involves the MongoDB C# driver's document-replacement feature. When replacing a document, the driver fails to validate element names or shapes properly. This allows untrusted input to be passed as a replacement value without neutralizing special query-language elements. As a result, the input may be interpreted as update logic by the database instead of data, executing under the application's credentials.

Detection Guidance

This vulnerability involves the MongoDB C# driver not validating element names in document replacements, allowing untrusted input to be interpreted as query logic. To detect it, inspect applications using MongoDB.Driver versions before 3.11.1 for untrusted input passed as replacements. Check logs for unusual database operations or queries originating from application inputs.

Impact Analysis

An attacker could exploit this to execute unauthorized database operations under the application's credentials. This may lead to data theft, modification, or deletion. Applications using loosely-typed input for document replacements are at risk, while strongly-typed mappings are unaffected.

Compliance Impact

This vulnerability allows untrusted input to be interpreted as database update logic, potentially enabling unauthorized data access or modification. For GDPR, this could lead to violations of data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity or availability. Affected applications must ensure input validation and strong typing to mitigate risks.

Mitigation Strategies

Upgrade to the latest version of MongoDB.Driver NuGet package (3.11.1 or higher) to ensure the vulnerability is patched. Review application code to avoid passing untrusted input as replacement values in document operations. Use strongly-typed document mappings where possible to prevent injection.

Hi! I’m here to help you understand CVE-2026-81528. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70