MongoDB C# Driver CVE-2026-114648

Exploitable only when the application passes attacker-controllable input into field-name positions of LINQ queries - specifically dictionary keys, field names, or array-filter identifiers - using the MongoDB C

Driver prior to v3.13.0; input used purely as query values (not as field paths) is not affected. The CVSS PR:L indicates app-level authentication is required, so the attacker must be a legitimate application user, not anonymous. Limiting factors: the vulnerability is inert in applications that never derive field names/keys from user input, and it is fixed in driver v3.13.0, which now rejects LINQ field names the server would reinterpret.

This is a genuine but moderate-priority issue rather than an emergency. The MongoDB-assigned CVSS 4.0 base is 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H), which maps to network-reachable, low-complexity exploitation requiring low privileges (PR:L) - consistent with the description's 'application user whose input reaches these positions,' i.e. an authenticated app-level user, not an anonymous internet attacker. Severity is driven mainly by availability (VA:H): malformed field writes can leave stored documents unreadable until repaired; confidentiality and integrity impacts are rated low (VC:L/VI:L) - cross-tenant document exposure and over-broad updates. The vuln.today decision label is 'this_week,' not 'act_now' or 'emergency.' No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no signal of active or widespread exploitation; this is a vendor-self-reported (cna@mongodb.com) defensive hardening fix. The real-world risk is gated by an application-specific precondition - the app must route untrusted user input into field-name/key/array-filter positions of LINQ queries - so exploitability varies heavily by how each application is written. EPSS is absent (not low), so no probabilistic exploitation estimate can be given; treat prioritization as driven by CVSS and the 'this_week' label.

An authenticated user of a .NET application built on the MongoDB C

Driver (before v3.13.0) supplies input - such as a dictionary key, field name, or array-filter identifier - containing dot or dollar characters that the application forwards into a LINQ query or update. Because the driver does not neutralize these characters, the crafted input rewrites the server-side field path so a read exposes other users' documents or an update widens beyond the intended fields, and certain values can corrupt documents so they become unreadable. No public exploit was identified at time of analysis.