Vulnerability · Published Aug 27, 2026 · Assigned by mongodb
CVE-2026-81528NoSQL injection via array replacement bypassing update shape validation in driver write path
Medium 5.4
In plain English
A medium-severity security flaw in C# Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.
Affected products (as reported)
Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N