CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace

Published Oct 22, 2026

Updated

The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.

Affected Software

1 affected component

MongoDB MongoDB C# Driver

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using the MongoDB C# Driver are exposed if they call FindOneAndReplace and construct the replacement document with field names derived from untrusted user input. The issue is specific to replacement documents that contain a top-level field name beginning with a dollar sign.

What does an attacker need to exploit it?

An attacker needs the ability to influence a top-level field name in the replacement document used by the application's FindOneAndReplace call. They do not need to control the query filter, but the modification is limited to the document that the application's own filter matches.

Are applications using normal replacement documents affected?

The described behavior requires a top-level dollar-prefixed field name in the replacement document. Applications that do not allow user input to become replacement-document field names do not meet the stated exploitation condition.

What can be done before updating the driver?

Ensure that untrusted input cannot define top-level field names in documents passed to FindOneAndReplace. Reject or sanitize dollar-prefixed field names and use an explicitly defined replacement-document schema.

CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are applications using normal replacement documents affected?

What can be done before updating the driver?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are applications using normal replacement documents affected?

What can be done before updating the driver?