{"id":"CVE-2026-126982","kind":"vulnerability","aliases":["CVE-2026-126982"],"related":[],"title":"MongoDB C# Driver: type allow-list bypass lets crafted BSON run code","description":"A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later deserializes can cause the application process to instantiate .NET types outside the intended allow-list and populate them with unauthorized party-controlled values. In applications that contain a suitable gadget type, this can lead to arbitrary code execution in the context of the application, with corresponding loss of confidentiality, integrity, and availability. No special privileges beyond the ability to introduce data the application reads are required.","summary":"The BSON serialization library in the MongoDB C# Driver can be tricked into building .NET types that the application's allow-list should block when it reads polymorphic data. An attacker who can supply BSON or JSON the application later deserializes may get code execution in the application process if a suitable gadget type is present.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bson","csharp","dotnet","mongodb","nuget","package"],"not_affected_if":["no-polymorphic-deserialization","trusted-data-only"],"how_to_check":"- Find MongoDB.Bson / MongoDB.Driver versions in .csproj or packages.lock.json (dotnet list package).\n- Look for object-typed or interface-typed members, or custom ObjectSerializer / AllowedTypes delegates, in models read from MongoDB or BSON/JSON that untrusted parties can write to.\n- Affected and fixed versions are not yet published; re-check the MongoDB C# driver advisories page.","fix":null,"status":"open","published_at":"2026-11-13T00:20:13+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","triaged_at":"2026-11-13T00:41:19+00:00","updated_at":"2026-11-13T00:42:40+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-13T00:41:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"MongoDB C# Driver: type allow-list bypass lets crafted BSON run code","impact":"high","summary":"The BSON serialization library in the MongoDB C# Driver can be tricked into building .NET types that the application's allow-list should block when it reads polymorphic data. An attacker who can supply BSON or JSON the application later deserializes may get code execution in the application process if a suitable gadget type is present.","audience":"developers","category":"package","nicknames":[],"who_cares":["csharp","dotnet","mongodb","bson"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary code runs in the application process if a gadget type exists","analyst_note":"Find the fixed MongoDB C# Driver version and any vendor advisory on NVD or MongoDB's security page; sources gave no fix or check.","how_to_check":"- Check the MongoDB C# Driver version in the project's package references (for example `MongoDB.Driver` or `MongoDB.Bson` in the .csproj or packages.lock.json).\n- Search the code for polymorphic deserialization into loosely typed members (object or interface fields) with type discriminators read from untrusted input.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-polymorphic-deserialization","trusted-data-only"],"who_is_affected":"Applications that use the MongoDB C# Driver's BSON library to deserialize polymorphic data into loosely typed members, where the data can come from an untrusted party. Applications that only read trusted, fixed-shape documents, or that do not use polymorphic deserialization, are less exposed. Whether a suitable gadget type exists depends on the application's dependencies, which the sources do not say.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000794,"input_tokens":4671,"output_tokens":654,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed MongoDB C# Driver version and any vendor advisory on NVD or MongoDB's security page; sources gave no fix or check.","search":"'-126982':16A,19A '-2026':15A,18A 'abil':190C 'allow':6A,47B,86C,99C,145C 'allow-list':5A,46B,85C,144C 'applic':44B,65B,74B,129C,135C,157C,176C,195C 'arbitrari':168C 'attack':57B 'avail':184C 'beyond':188C 'block':50B 'bson':11A,20B,27B,61B,91C 'bson/json':125C 'build':39B 'bypass':8A,88C 'c':2A,33B,97C 'caus':133C 'check':104C 'circumv':107C 'code':13A,70B,169C 'confidenti':181C 'contain':159C 'context':173C 'control':154C 'correspond':178C 'craft':10A 'csharp':21B 'cve':14A,17A 'data':55B,110C,126C,193C 'deseri':67B,112C,131C 'dotnet':22B 'driver':3A,34B,98C 'execut':71B,170C 'gadget':79B,162C 'get':69B 'instanti':138C 'integr':182C 'intend':143C 'introduc':192C 'json':63B 'later':66B,130C 'lead':166C 'let':9A 'librari':29B,93C 'list':7A,48B,87C,146C 'loos':114C 'loss':179C 'may':68B 'member':116C 'mongodb':1A,23B,32B,96C 'net':40B,139C 'nuget':24B 'outsid':141C 'packag':25B 'parti':119C,153C 'party-control':152C 'plant':124C 'polymorph':54B,109C 'popul':148C 'present':82B 'privileg':187C 'process':75B,136C 'read':53B,196C 'requir':198C 'restrict':103C 'run':12A 'serial':28B,92C 'special':186C 'suitabl':78B,161C 'suppli':60B,122C 'trick':37B 'type':4A,41B,80B,84C,102C,115C,140C,163C 'type-restrict':101C 'unauthor':118C,151C 'valu':155C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the MongoDB C# Driver's BSON library to deserialize polymorphic data into loosely typed members, where the data can come from an untrusted party. Applications that only read trusted, fixed-shape documents, or that do not use polymorphic deserialization, are less exposed. Whether a suitable gadget type exists depends on the application's dependencies, which the sources do not say.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bson","csharp","dotnet","high","mongodb","nuget","package"],"campaign_type":null,"search_a":"'-126982':16A,19A '-2026':15A,18A 'allow':6A 'allow-list':5A 'bson':11A 'bypass':8A 'c':2A 'code':13A 'craft':10A 'cve':14A,17A 'driver':3A 'let':9A 'list':7A 'mongodb':1A 'run':12A 'type':4A","search_b":"'allow':47B 'allow-list':46B 'applic':44B,65B,74B 'attack':57B 'block':50B 'bson':20B,27B,61B 'build':39B 'c':33B 'code':70B 'csharp':21B 'data':55B 'deseri':67B 'dotnet':22B 'driver':34B 'execut':71B 'gadget':79B 'get':69B 'json':63B 'later':66B 'librari':29B 'list':48B 'may':68B 'mongodb':23B,32B 'net':40B 'nuget':24B 'packag':25B 'polymorph':54B 'present':82B 'process':75B 'read':53B 'serial':28B 'suitabl':78B 'suppli':60B 'trick':37B 'type':41B,80B","search_c":"'abil':190C 'allow':86C,99C,145C 'allow-list':85C,144C 'applic':129C,135C,157C,176C,195C 'arbitrari':168C 'avail':184C 'beyond':188C 'bson':91C 'bson/json':125C 'bypass':88C 'c':97C 'caus':133C 'check':104C 'circumv':107C 'code':169C 'confidenti':181C 'contain':159C 'context':173C 'control':154C 'correspond':178C 'data':110C,126C,193C 'deseri':112C,131C 'driver':98C 'execut':170C 'gadget':162C 'instanti':138C 'integr':182C 'intend':143C 'introduc':192C 'later':130C 'lead':166C 'librari':93C 'list':87C,146C 'loos':114C 'loss':179C 'member':116C 'mongodb':96C 'net':139C 'outsid':141C 'parti':119C,153C 'party-control':152C 'plant':124C 'polymorph':109C 'popul':148C 'privileg':187C 'process':136C 'read':196C 'requir':198C 'restrict':103C 'serial':92C 'special':186C 'suitabl':161C 'suppli':122C 'type':84C,102C,115C,140C,163C 'type-restrict':101C 'unauthor':118C,151C 'valu':155C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T00:20:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126982","severity":null,"published_at":"2026-11-13T00:20:13+00:00","modified_at":"2026-11-13T00:20:13+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","fetched_at":"2026-11-13T00:41:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126982:3795","url":null,"severity":null,"published_at":"2026-11-13T00:42:40+00:00","modified_at":"2026-11-13T00:42:40+00:00","first_seen_at":"2026-11-13T00:42:40+00:00","fetched_at":"2026-11-13T00:42:40+00:00","note":"No vendor advisory, GitHub advisory or release note found for this CVE as of 2026-11-13. It is not in the 3.13.0 list (22 Oct 2026), which fixes CVE-2026-114643 to -114654. 3.13.0 is the newest release I saw. Fixed version unknown. Check the mongo-csharp-driver advisories and MongoDB Security Bulletins again later. Nothing verified. Related older work: CVE-2022-48282 added ObjectSerializer AllowedTypes in 2.19.0."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}