---
id: "CVE-2026-126982"
page: "https://infrastack.ai/live/CVE-2026-126982"
kind: "vulnerability"
aliases: ["CVE-2026-126982"]
title: "MongoDB C# Driver: type allow-list bypass lets crafted BSON run code"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bson", "csharp", "dotnet", "mongodb", "nuget", "package"]
not_affected_if: ["no-polymorphic-deserialization", "trusted-data-only"]
published_at: "2026-11-13T00:20:13+00:00"
first_seen_at: "2026-11-13T00:41:07+00:00"
updated_at: "2026-11-13T00:42:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126982", "first_seen_at": "2026-11-13T00:41:07+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T00:42:40+00:00"}]
exploit_sources: []
---

# MongoDB C# Driver: type allow-list bypass lets crafted BSON run code

Link for people: https://infrastack.ai/live/CVE-2026-126982 (this .md is for agents)

The BSON serialization library in the MongoDB C# Driver can be tricked into building .NET types that the application's allow-list should block when it reads polymorphic data. An attacker who can supply BSON or JSON the application later deserializes may get code execution in the application process if a suitable gadget type is present.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find MongoDB.Bson / MongoDB.Driver versions in .csproj or packages.lock.json (dotnet list package).
- Look for object-typed or interface-typed members, or custom ObjectSerializer / AllowedTypes delegates, in models read from MongoDB or BSON/JSON that untrusted parties can write to.
- Affected and fixed versions are not yet published; re-check the MongoDB C# driver advisories page.

## Timeline

- 2026-11-13T00:41:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126982
- 2026-11-13T00:42:40+00:00 analyst — No vendor advisory, GitHub advisory or release note found for this CVE as of 2026-11-13. It is not in the 3.13.0 list (22 Oct 2026), which fixes CVE-2026-114643 to -114654. 3.13.0 is the newest release I saw. Fixed version unknown. Check the mongo-csharp-driver advisories and MongoDB Security Bulletins again later. Nothing verified. Related older work: CVE-2022-48282 added ObjectSerializer AllowedTypes in 2.19.0.

## From the sources

A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later deserializes can cause the application process to instantiate .NET types outside the intended allow-list and populate them with unauthorized party-controlled values. In applications that contain a suitable gadget type, this can lead to arbitrary code execution in the context of the application, with corresponding loss of confidentiality, integrity, and availability. No special privileges beyond the ability to introduce data the application reads are required.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_