EUVD-2026-108323Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with ordinary app read-write access
-
ExploitSubmit crafted value to vulnerable update builder
-
ExecutionValue reinterpreted as update-operator logic
-
ImpactModify or delete unintended stored data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Exploitation requires that the application pass attacker-influenced values directly into the affected update builder surface vulnerable to single-element list rewriting (CSHARP-6168); the attacker needs ordinary authenticated read-write application access (PR:L), so it is not exploitable by anonymous outsiders against a hardened app. There is no user interaction required and the path is reachable over the network via the application. The key LIMITING factor is application coding pattern: if the application does not feed externally-controlled data into this builder surface, the flaw is not reachable - this is a library-usage-dependent injection, not a flaw triggered against a default configuration on its own. |
| Impact | This is a moderate, integrity-only NoSQL injection (CWE-943) in the update-statement builder of the MongoDB C Driver, tracked internally as CSHARP-6168 (update operator injection via single-element list rewriting). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and score of 7.1 are internally consistent with the description: network-reachable through the application, low attacker effort, but requiring ordinary authenticated read-write application access (PR:L) and yielding only integrity impact (VI:H) with no confidentiality or availability loss. No EPSS score, no CISA KEV listing, and no public exploit code were provided - the only references are the vendor's v3.13.0 release notes and JIRA ticket, i.e. patch/advisory material, not exploit material, so exploitation signals are limited. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency priority consistent with the absence of KEV/active-exploitation evidence. Net: a real but application-conditional issue - it is not a remote-unauthenticated RCE and its blast radius is data integrity within the affected application, so treat it as a 'patch this cycle' library update rather than a drop-everything emergency. |
| Exploit ScenarioDerived | An application user with ordinary read-write access supplies a crafted value that the application passes into the MongoDB C Driver's update builder; via single-element list rewriting (CSHARP-6168) the value is reinterpreted as update-operator logic rather than literal data, causing stored documents to be modified or removed beyond what the application intended. No public exploit code was identified in the provided sources; MongoDB fixed the behavior in driver v3.13.0. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Integrity-only NoSQL injection in the MongoDB C
Driver update-statement builder allows an authenticated application user with ordinary read-write access to influence update logic, potentially modifying or deleting stored data the application did not intend to change. The flaw is tracked as CSHARP-6168 and affects releases before 3.13.0; exploitation depends on the application passing attacker-influenced values directly into the affected update builder surface, so it is not reachable against a hardened application that does not do so. No public exploit was identified in the provided intelligence at time of analysis, and the primary remediation is upgrading to MongoDB .NET/C
Driver 3.13.0.
RemediationAI
Upgrade to MongoDB .NET/C
Driver 3.13.0, which contains the CSHARP-6168 fix, and review the 3.13.0 release notes for behavior changes affecting generated updates, replacement documents that begin with an operator, and LINQ field-name handling. If an immediate upgrade is not possible, the limiting factor is application usage: do not pass externally controlled values into the affected update builder surface, and validate or explicitly wrap values that could arrive as single-element lists so they are treated as literal data rather than update logic. The provided sources do not describe a separate vendor workaround; the release notes identify 3.13.0 as the version that addresses this issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-943 covers improper neutralization of special elements in data query logic, and this CVE is a library-usage-dependent NoSQL injection in the MongoDB C#/.NET Driver's update-statement construction component. The vendor release notes identify CSHARP-6168 as update operator injection via single-element list rewriting in the update builder: application-supplied values can be interpreted as query/update logic instead of literal data, giving an attacker who can influence values passed into that builder surface the ability to alter or remove stored data. The provided release-note excerpt names the issue but truncates the full behavior-change text; what is confirmed is that version 3.13.0 tightens input handling, changes the shape of some generated updates, rejects replacement documents that start with an operator, and rejects LINQ field names that the server would reinterpret. The CVSS vector contains PR:L, so the attacker is an authenticated application user, and the flaw is not exploitable by anonymous outsiders unless the application itself exposes the vulnerable builder pattern to them.
Know when MongoDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Reachable over the network through the app with low complexity but requires ordinary authenticated read-write access (PR:L); impact is integrity-only (I:H), with no confidentiality or availability effect.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C
Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.
Articles & Coverage 2
Technical POC Analysis
CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), implemented as update-operator injection in the client-side update-statement builder of the MongoDB C# Driver (MongoDB.Drive…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity integrity flaw in the MongoDB C
Driver (CSHARP-6168) could allow an authenticated application user with ordinary read-write access to inadvertently modify or delete stored data through the update-statement builder. This affects applications that pass user-supplied values directly into the builder without hardened input validation, potentially undermining data integrity and eroding customer trust. Leadership should prioritize remediation to prevent unauthorized data changes that could disrupt business operations and compliance.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict input validation and sanitization for all values passed to update builders; restrict database user permissions to least privilege; monitor and alert on unexpected data modifications or deletions; consider temporary application-level restrictions on update operations until upgrade is possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Exploit-DB