CVE-2026-114652

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.

• CWE-943

• https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
• https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-7gfh-w7g4-x3p9
• https://jira.mongodb.org/browse/CSHARP-6168

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114647The MongoDB C# Driver does not reject replacement documents …4.3
• CVE-2026-114648The MongoDB C# Driver does not neutralize dot and dollar cha…7.6
• CVE-2026-114649The MongoDB C# Driver compares TLS client certificates by is…6.8
• CVE-2026-11465A security flaw has been discovered in songquanpeng one-api …3.1
• CVE-2026-114650A flaw in the client-side encryption support of the MongoDB …5.9
• CVE-2026-114651A memory-handling weakness in the BSON deserialization compo…4
• CVE-2026-114653A client-side encryption schema construction component in th…6.5
• CVE-2026-114654A numeric-type conversion flaw in the BSON handling library …6.5
• CVE-2026-114655libmongocrypt builds requests to external key management ser…5.9
• CVE-2026-114656Traefik before 2.11.58 and 3.7.13 contains an authentication…7.5
• CVE-2026-114657Grav from 2.0.0 before 2.2.5 contains an information disclos…5.7
• CVE-2026-114658Grav Login plugin from 3.6.0 before 3.9.13 contains a missin…8.8