Live › vulnerability › CVE-2026-114648
Go to dashboardThe MongoDB C# Driver does not escape dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before building field paths. An application user whose input reaches these positions can redirect queries or updates to fields the application did not name, exposing other users' documents or widening updates.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications using the MongoDB C# Driver that build query or update field paths from user-controlled input, such as dynamic field selection, dictionary keys or array-filter names. Applications that use only fixed, developer-chosen field names are not exposed by this flaw.
No product ranges from the sources yet.
dotnet list package | grep MongoDB.Driver.MongoDB.Driver) to the first patched version; the exact version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.
This page as .md · .json · in your agent: get_signal("CVE-2026-114648")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.