MongoDB C# Driver CVE-2026-81527

Exploitation requires that the target application uses the MongoDB C

Driver's LINQ-to-aggregation or query filter translation layer, AND that application-supplied (i.e., user-controlled) values are embedded into the affected LINQ query constructs without independent sanitization. Applications that use the MongoDB query builder API without passing user input through LINQ translation, or that sanitize inputs before query construction, are not vulnerable. Authentication requirements depend entirely on the application: the driver-level flaw itself operates without any credential check (PR:N in CVSS), but the attacker must be able to reach an application endpoint that feeds user input into an affected query. Exploitation is limited to data disclosure and query result manipulation - no code execution is implied. Specific platform or OS prerequisites do not apply; the vulnerability is in the cross-platform .NET library.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) signals that exploitation requires no authentication, no special configuration, and no user interaction - a low-friction attack for any application that exposes user input paths into affected LINQ queries. However, the impact metrics (VC:L/VI:L/VA:N) are deliberately modest: the vulnerability enables unintended data disclosure and query result manipulation, not full compromise, remote code execution, or availability loss. EPSS data is not available in the provided intelligence. KEV status is absent, and no public proof-of-concept is referenced. The realistic risk is application-dependent: only codebases that use the driver's LINQ-to-aggregation or query filter translation with user-controlled input are exposed. Applications using parameterized or builder-pattern queries that do not pass raw user values through the affected translation paths are not at risk. The principal concern is data exfiltration via filter bypass, where an attacker could retrieve records outside their intended access scope.

An attacker submitting a search or filter request to a .NET web application discovers that the application passes user-supplied search terms directly through a LINQ-to-MongoDB aggregation query. By embedding MongoDB query operators or expression syntax within their input, the attacker alters the query's filter logic - for example, causing a membership or ownership filter to be bypassed - and receives records belonging to other users. No public proof-of-concept is identified at time of analysis, but the injection class is well understood and low complexity to exploit once an injection point is identified.