Medium 4.3Published Oct 22, 2026

CVE-2026-114647NoSQL operator injection via unvalidated replacement document in findOneAndReplace

Updated under an hour ago (Oct 28, 2026, 3:40 AM ET)

Does this affect you?

It affects MongoDB C# Driver. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for MongoDB C# Driver

Exploited in the last 30 days

The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.

CVSS: 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE): CWE-943
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: mongodb
NVD analysis: Awaiting Analysis
Record last updated: Oct 22, 2026
First seen by InfoSec Signals: Oct 22, 2026

Affected products

Affected products

MongoDB C# Driver mongodb:c_driver (from the name)	from 2.13.0 before 3.13.0	CNA record

References

References

https://jira.mongodb.org/browse/CSHARP-6186
https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-68cj-624m-mxj3

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.