{"id":"CVE-2026-114648","kind":"vulnerability","aliases":["CVE-2026-114648"],"related":[],"title":"MongoDB C# Driver: unescaped dot and dollar keys let users reach other fields","description":"The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.","summary":"The MongoDB C# Driver does not escape dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before building field paths. An application user whose input reaches these positions can redirect queries or updates to fields the application did not name, exposing other users' documents or widening updates.","severity":"high","cvss":7.6,"epss":0.00321,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["csharp","dotnet","mongodb","package","self-hosted"],"not_affected_if":["fixed-field-names","no-user-controlled-keys"],"how_to_check":"- Look for LINQ queries or update builders in the C# code that use user-supplied strings as dictionary keys, field names or array-filter identifiers.\n- Check the installed driver version with `dotnet list package | grep MongoDB.Driver`.","fix":"- Upgrade the MongoDB C# Driver (NuGet `MongoDB.Driver`) to the first patched version; the exact version is unknown from the sources.\n- Until patched, validate or allow-list user input used as field names and keys before it reaches LINQ queries.","status":"open","published_at":"2026-10-22T19:17:38+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:14:21+00:00","updated_at":"2026-10-25T03:14:21+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:14:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the MongoDB C# Driver (NuGet `MongoDB.Driver`) to the first patched version; the exact version is unknown from the sources.\n- Until patched, validate or allow-list user input used as field names and keys before it reaches LINQ queries.","reach":"internet","title":"MongoDB C# Driver: unescaped dot and dollar keys let users reach other fields","impact":"high","summary":"The MongoDB C# Driver does not escape dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before building field paths. An application user whose input reaches these positions can redirect queries or updates to fields the application did not name, exposing other users' documents or widening updates.","category":"package","nicknames":[],"who_cares":["csharp","dotnet","mongodb","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Other users' documents are read and unrelated fields are updated","analyst_note":"Find the patched driver version and the affected version range in the NVD entry or the MongoDB advisory; sources did not name them.","how_to_check":"- Look for LINQ queries or update builders in the C# code that use user-supplied strings as dictionary keys, field names or array-filter identifiers.\n- Check the installed driver version with `dotnet list package | grep MongoDB.Driver`.","needs_analyst":true,"not_affected_if":["fixed-field-names","no-user-controlled-keys"],"who_is_affected":"Applications using the MongoDB C# Driver that build query or update field paths from user-controlled input, such as dynamic field selection, dictionary keys or array-filter names. Applications that use only fixed, developer-chosen field names are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":3412,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114648':16A,19A '-2026':15A,18A 'also':157C 'applic':57B,72B,121C,137C,168C 'array':45B,101C 'array-filt':44B,100C 'beyond':150C 'build':53B 'c':2A,29B,85C 'certain':154C 'charact':37B,93C 'csharp':20B 'cve':14A,17A 'data':153C 'dictionari':39B,95C 'document':79B,146C,164C 'dollar':7A,36B,92C 'dot':5A,34B,90C 'dotnet':21B 'driver':3A,30B,86C 'escap':33B 'expos':76B,143C 'field':13A,41B,54B,70B,97C,113C,135C,160C 'filter':46B,102C 'host':26B 'identifi':47B,103C 'input':60B,124C 'intend':152C 'key':8A,40B,96C 'leav':162C 'let':9A 'linq':50B,106C 'malform':159C 'mongodb':1A,22B,28B,84C 'name':42B,75B,98C,140C 'neutral':89C 'packag':23B 'path':55B,114C 'place':109C 'posit':63B,127C 'queri':51B,66B,107C,131C 'reach':11A,61B,125C 'redirect':65B,129C 'repair':172C 'self':25B 'self-host':24B 'send':116C 'server':119C 'store':163C 'unescap':4A 'unread':165C 'updat':68B,82B,133C,149C 'use':48B,104C 'user':10A,58B,78B,122C,145C 'valu':155C 'whose':59B,123C 'widen':81B,148C 'write':158C","nicknames":[],"mitigations":[],"who_affected":"Applications using the MongoDB C# Driver that build query or update field paths from user-controlled input, such as dynamic field selection, dictionary keys or array-filter names. Applications that use only fixed, developer-chosen field names are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114648","severity":null,"published_at":"2026-10-22T19:17:38+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114648","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114648","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}