CVE-2026-126839: Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization
A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed when they deserialize attacker-influenced BSON into a loosely typed member. The attacker must be able to place that content into a BSON deserialization path used by the application.
What level of access does an attacker need?
No elevated privileges are required beyond the ability to supply or influence BSON content that the application later deserializes. Exploitation does not require user interaction.
What is the likely impact if exploitation succeeds?
Types outside the intended allow-list can be constructed and populated with attacker-supplied values. This can create unexpected object state and cause errors in downstream application logic.