---
id: "CVE-2026-120567"
kind: "vulnerability"
aliases: ["CVE-2026-120567"]
title: "MongoDB EF Core provider: caller input alters fields in bulk updates"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "entity-framework-core", "mongodb", "package"]
not_affected_if: ["no-bulk-update-with-user-input", "no-mongodb-efcore-provider"]
published_at: "2026-11-03T20:18:12+00:00"
first_seen_at: "2026-11-03T20:49:22+00:00"
updated_at: "2026-11-03T20:51:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120567", "first_seen_at": "2026-11-03T20:49:22+00:00"}]
---

# MongoDB EF Core provider: caller input alters fields in bulk updates

The MongoDB Entity Framework Core provider does not neutralize special syntax when it places a caller-supplied value into a bulk update expression. An attacker who controls that input can modify unintended fields in the records being updated and move existing data into other fields of the same record.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project references the MongoDB Entity Framework Core provider package (`MongoDB.EntityFrameworkCore`) in its `.csproj` or lock file.
- Look for bulk update calls (ExecuteUpdate or similar) that take user-supplied values in the update expression.

## Timeline

- 2026-11-03T20:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120567

## From the sources

The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal application input may causeunintended modification of fields in the records the application is updating, and may cause data already held in those records to be relocated into other fields of the same record.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_