{"id":"CVE-2026-120567","kind":"vulnerability","aliases":["CVE-2026-120567"],"related":[],"title":"MongoDB EF Core provider: caller input alters fields in bulk updates","description":"The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal application input may causeunintended modification of fields in the records the application is updating, and may cause data already held in those records to be relocated into other fields of the same record.","summary":"The MongoDB Entity Framework Core provider does not neutralize special syntax when it places a caller-supplied value into a bulk update expression. An attacker who controls that input can modify unintended fields in the records being updated and move existing data into other fields of the same record.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","entity-framework-core","mongodb","package"],"not_affected_if":["no-bulk-update-with-user-input","no-mongodb-efcore-provider"],"how_to_check":"- Check whether the project references the MongoDB Entity Framework Core provider package (`MongoDB.EntityFrameworkCore`) in its `.csproj` or lock file.\n- Look for bulk update calls (ExecuteUpdate or similar) that take user-supplied values in the update expression.","fix":null,"status":"open","published_at":"2026-11-03T20:18:12+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:51:46+00:00","updated_at":"2026-11-03T20:51:46+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T20:51:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"MongoDB EF Core provider: caller input alters fields in bulk updates","impact":"medium","summary":"The MongoDB Entity Framework Core provider does not neutralize special syntax when it places a caller-supplied value into a bulk update expression. An attacker who controls that input can modify unintended fields in the records being updated and move existing data into other fields of the same record.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","entity-framework-core","mongodb"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Unintended fields in stored records are modified or overwritten","analyst_note":"Find the affected and fixed package versions and the vendor advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-120567); the sources give no version range.","how_to_check":"- Check whether the project references the MongoDB Entity Framework Core provider package (`MongoDB.EntityFrameworkCore`) in its `.csproj` or lock file.\n- Look for bulk update calls (ExecuteUpdate or similar) that take user-supplied values in the update expression.","plain_action":"","needs_analyst":true,"not_affected_if":["no-mongodb-efcore-provider","no-bulk-update-with-user-input"],"who_is_affected":"Applications that use the MongoDB Entity Framework Core provider and pass caller-supplied values into bulk update operations are exposed. Applications that do not use this provider, or that never feed request data into bulk updates, are unlikely to be affected. The sources do not give the affected version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4155,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120567':14A,17A '-2026':13A,16A 'alreadi':143C 'alter':7A 'applic':125C,136C 'attack':50B 'bulk':10A,46B,96C 'caller':5A,41B,91C 'caller-suppli':40B,90C 'caus':141C 'causeunintend':128C 'control':52B 'core':3A,22B,29B,79C 'cve':12A,15A 'data':67B,110C,142C 'databas':116C 'databasea':103C 'dotnet':18B 'ef':2A 'element':85C 'entiti':20B,27B,77C 'entity-framework-cor':19B 'exist':66B 'express':48B,100C,118C 'field':8A,58B,70B,131C,153C 'framework':21B,28B,78C 'held':144C 'input':6A,54B,126C 'interpret':113C 'may':111C,127C,140C 'modif':129C 'modifi':56B 'mongodb':1A,23B,26B,76C 'move':65B 'neutral':33B,83C 'normal':124C 'packag':24B 'part':121C 'place':38B,88C 'plain':109C 'provid':4A,30B,80C 'record':61B,74B,134C,147C,157C 'reloc':150C 'result':104C 'special':34B,84C 'suppli':42B,92C,107C 'syntax':35B,119C 'unintend':57B 'updat':11A,47B,63B,97C,138C 'valu':43B,93C,106C,122C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the MongoDB Entity Framework Core provider and pass caller-supplied values into bulk update operations are exposed. Applications that do not use this provider, or that never feed request data into bulk updates, are unlikely to be affected. The sources do not give the affected version range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","entityframeworkcore","medium","mongodb","package"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120567","severity":null,"published_at":"2026-11-03T20:18:12+00:00","modified_at":"2026-11-03T20:18:12+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}