CVE-2026-126982: Remote code execution via generic-type allow-list bypass in BSON object deserialization
A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later deserializes can cause the application process to instantiate .NET types outside the intended allow-list and populate them with unauthorized party-controlled values. In applications that contain a suitable gadget type, this can lead to arbitrary code execution in the context of the application, with corresponding loss of confidentiality, integrity, and availability. No special privileges beyond the ability to introduce data the application reads are required.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the MongoDB C# Driver's BSON serialization library are exposed when they deserialize BSON or JSON into loosely typed members with polymorphic data and rely on a type allow-list restriction. Exploitation additionally depends on the application containing a suitable .NET gadget type.
What access does an attacker need to exploit it?
An attacker needs the ability to supply BSON or JSON data, or plant data that the application will later read and deserialize. No special privileges beyond introducing that data are required.
Is remote code execution guaranteed if the allow-list is bypassed?
No. The bypass permits instantiation of .NET types outside the intended allow-list with attacker-controlled values; arbitrary code execution requires a suitable gadget type to be present in the application.
What is the impact if exploitation succeeds?
Code execution would occur in the context of the affected application process. This can result in loss of confidentiality, integrity, and availability.