CVE-2026-81529

Name of the Vulnerable Software and Affected Versions MongoDB C# Driver (affected versions not specified)

Description Improper neutralization of delimiters during connection-URL construction enables connection-option injection. This occurs when an application passes untrusted text into the driver's connection-URL builder and subsequently round-trips that builder into a client configuration. The untrusted text is serialized without neutralizing URL or option delimiters and is later re-parsed as authoritative connection options, allowing a low-privileged user to introduce or suppress security-relevant connection settings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Sanitize all inputs passed to the connection-URL builder.