Live › vulnerability › CVE-2026-114647
Go to dashboardThe MongoDB C# Driver's FindOneAndReplace does not reject replacement documents whose top-level field names start with a dollar sign, unlike other replace operations. If the application builds such a document from user-supplied field names, the server can apply update operators instead of a full replacement, modifying the matched document in unintended ways.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications using the MongoDB C# Driver's FindOneAndReplace where the replacement document is built from user-supplied top-level field names. Applications that use fixed document shapes, or that do not call FindOneAndReplace with user-controlled keys, are not exposed. The effect is limited to the document matched by the application's own filter.
No product ranges from the sources yet.
FindOneAndReplace calls that build the replacement document from user-supplied field names.dotnet list package and look for MongoDB.Driver below the fixed release.MongoDB.Driver NuGet package to a patched version (unknown exact version; the sources do not say).$.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.
This page as .md · .json · in your agent: get_signal("CVE-2026-114647")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.