CVE-2026-114648
Description
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.
How to fix
- MongoDB C# Driver3.13.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MongoDB C# Driver | 2.14.0 ≤ v < 3.13.0 | 3.13.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.