---
id: "CVE-2026-114648"
kind: "vulnerability"
aliases: ["CVE-2026-114648"]
title: "MongoDB C# Driver: unescaped dot and dollar keys let users reach other fields"
severity: "high"
cvss: 7.6
epss: 0.00321
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["csharp", "dotnet", "mongodb", "package", "self-hosted"]
not_affected_if: ["fixed-field-names", "no-user-controlled-keys"]
published_at: "2026-10-22T19:17:38+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:14:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114648", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114648", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# MongoDB C# Driver: unescaped dot and dollar keys let users reach other fields

The MongoDB C# Driver does not escape dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before building field paths. An application user whose input reaches these positions can redirect queries or updates to fields the application did not name, exposing other users' documents or widening updates.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for LINQ queries or update builders in the C# code that use user-supplied strings as dictionary keys, field names or array-filter identifiers.
- Check the installed driver version with `dotnet list package | grep MongoDB.Driver`.

## Fix

- Upgrade the MongoDB C# Driver (NuGet `MongoDB.Driver`) to the first patched version; the exact version is unknown from the sources.
- Until patched, validate or allow-list user input used as field names and keys before it reaches LINQ queries.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114648
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114648

## From the sources

The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_