CVE-2026-81528: NoSQL injection via array replacement bypassing update shape validation in driver write path
A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they pass untrusted, loosely typed input as a document replacement through the affected MongoDB C# driver write path. Applications using strongly typed document mappings are not affected.
What must an attacker be able to do to exploit it?
An attacker needs to supply a replacement value through an application path that accepts untrusted, loosely typed input. The injected update logic executes using the application's database credentials.
What can be done while assessing or mitigating exposure?
Avoid passing untrusted loosely typed values as replacement documents, and use strongly typed document mappings where possible. Review replacement-style write operations separately from other update paths, because the omitted validation is specific to the document-replacement path.