CVE-2026-126982

Name of the Vulnerable Software and Affected Versions MongoDB C# Driver (affected versions not specified)

Description A type allow-list bypass exists in the BSON serialization library. This issue occurs when polymorphic data is deserialized into loosely typed members, allowing a type-restriction check to be circumvented. An unauthorized party capable of supplying BSON/JSON data can force the application to instantiate .NET types outside the intended allow-list and populate them with controlled values. If the application contains a suitable gadget type—a class that can be leveraged to perform unintended actions during instantiation—this can lead to arbitrary code execution, resulting in a loss of confidentiality, integrity, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.