CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the MongoDB C# Driver are exposed when they place application-supplied values into affected LINQ aggregation-expression or query-filter constructs. The relevant risk is to applications where an untrusted user can influence those values.
What does an attacker need to exploit it?
An attacker needs the ability to supply a value that the application incorporates into an affected translated query. No authentication, user interaction, or special attack complexity is indicated by the supplied severity vector.
What could exploitation allow?
Special elements in the supplied value may be interpreted as database query logic instead of data. This can cause unintended data to be returned or alter query results, with low confidentiality and integrity impact indicated.