CVE-2026-81529: Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications are exposed when they pass untrusted text into the MongoDB C# Driver's connection-URL builder and then use the builder's serialized URL to create or configure a client. Applications that do not place user-controlled values into this build-and-round-trip flow are not described as affected.
What access does an attacker need?
An attacker needs low-privileged access to an affected application and a way to supply text that the application inserts into the driver's connection-URL builder. No user interaction is required after the attacker supplies that input.
What can exploitation change?
The injected delimiters can cause attacker-controlled text to be re-parsed as connection options, allowing security-relevant settings to be introduced or suppressed. The provided data rates the impact as high confidentiality impact and low integrity impact, with no availability impact.