CVE-2026-81529

Analyzed Analyzed - Analysis Complete

Connection-Option Injection in MongoDB C# Driver

Publication date: 2026-08-27

Last updated on: 2026-09-29

Assigner: MongoDB, Inc.

Description

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-29

Generated

2026-10-07

AI Q&A

2026-08-28

EPSS Evaluated

2026-10-06

NVD

CVE-2026-81529

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	c#_driver	From 2.10.0 (inc) to 3.11.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper neutralization of delimiters in connection-URL construction in the MongoDB C# Driver. When untrusted text is passed into the driver's connection-URL builder and then converted back into client configuration, the text is serialized without removing URL or option delimiters. This allows a low-privileged user to inject or alter security-relevant connection settings.

Detection Guidance

This vulnerability involves improper neutralization of delimiters in MongoDB C# Driver connection-URL construction. Detection requires reviewing application code that uses the MongoDB C# Driver to build connection URLs from untrusted input. Look for instances where user-controlled data is passed into connection-URL builders without proper sanitization.

Impact Analysis

An attacker could exploit this to introduce malicious connection options, potentially bypassing security controls, accessing unauthorized data, or disrupting database operations. Applications using the MongoDB C# Driver with untrusted input in connection URLs are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations may face compliance violations if exploited, resulting in legal or financial penalties.

Mitigation Strategies

Immediately update to the latest version of the MongoDB C# Driver that patches this issue. Review all application code that constructs MongoDB connection URLs to ensure untrusted input is properly sanitized before being passed to the driver. Implement strict input validation for any user-provided connection parameters.

Hi! I’m here to help you understand CVE-2026-81529. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70