MongoDB C# Driver CVE-2026-114646

Exploitation requires the target application to construct a raw BSON document or array (RawBsonDocument/LazyBsonDocument) from externally supplied binary data and then issue it as or within a database command, using a vulnerable driver version (2.0.0 up to but excluding 3.13.0). The specific trigger is a BSON length prefix that does not match the actual buffer, which the pre-fix driver copies to the wire verbatim; impact is bounded by the database privileges the application itself holds. The main limiting factor is this application coding pattern - apps that do not build BSON from attacker-influenced binary input are not exposed - rather than any network or authentication barrier (PR:N, UI:N). No EPSS/KEV data and no working public exploit were provided.

This is a medium-severity (CVSS 4.0 base 6.9) NoSQL/BSON command-injection flaw (CWE-130, length-parameter inconsistency) in the MongoDB C

Driver, confirmed and scored by the MongoDB CNA. The CVSS vector AV:N/AC:L/AT:N/PR:N/UI:N indicates a network-reachable issue requiring no privileges or user interaction, with limited confidentiality and integrity impact (VC:L/VI:L) and no availability impact. The 'unauthenticated' characterization is supported by PR:N and by the description, which notes the attacker needs no database credentials of their own - but the real limiter is a code-path precondition, not an access-control one: the victim application must itself construct a raw or lazy BSON document from externally supplied binary data and send it on the wire. It is therefore not blanket remote-unauthenticated exploitation of a default service; it depends on how the application uses the driver. No EPSS score and no KEV status were supplied, and there is no CISA KEV listing in the input, so there is no signal of active exploitation; the only references are the vendor release notes and the CSHARP-6157 JIRA ticket, neither of which is a working exploit. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent priority: patch in a normal maintenance cycle. One conflict to verify: the input Tags label this 'Authentication Bypass', but the vendor release notes explicitly describe CSHARP-6157 as 'NoSQL command injection' - the tag appears mislabeled and the vulnerability is an injection/data-validation flaw, not an authentication bypass.

An application uses the MongoDB C

Driver to build a RawBsonDocument or LazyBsonDocument directly from binary data that an unauthenticated external party can influence (for example an uploaded or forwarded binary blob), then issues a database command built from it. Because the driver copies the buffer to the wire without checking that the declared BSON length prefix matches the actual data, the attacker crafts a mismatched length prefix so that extra command elements are appended or existing ones dropped, altering the command the application sends. No public working exploit was identified at time of analysis; only the vendor advisory and JIRA ticket are referenced.