CVE-2026-81528

Name of the Vulnerable Software and Affected Versions MongoDB C# driver (affected versions not specified)

Description A document-replacement code path in the MongoDB C# driver fails to perform element-name and shape validation. This allows values supplied as replacements to be forwarded to the server without neutralizing query-language special elements. Consequently, applications that pass untrusted, loosely-typed input as a replacement value may allow that input to be interpreted by the database as update logic instead of data, executing with the application's database credentials. Applications utilizing strongly-typed document mappings are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.