CVE-2026-114647

Name of the Vulnerable Software and Affected Versions MongoDB C# Driver (affected versions not specified)

Description In the FindOneAndReplace function, the driver fails to reject replacement documents that contain top-level field names starting with a dollar sign. If an application constructs these documents using user-supplied field names, the server may interpret them as update operators rather than performing a full document replacement. This allows the contents of the document matched by the application filter to be modified in unintended ways.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.