MongoDB C# Driver CVE-2026-81528

Three concrete conditions must all be met: (1) The application uses MongoDB.Driver (C

NuGet) in a version prior to 3.11.1. (2) The application performs document-replacement operations (ReplaceOne, ReplaceOneAsync, or equivalent) using loosely-typed input - specifically BsonDocument, Dictionary-based types, or dynamic objects - rather than strongly-typed C

model classes; the CVE description explicitly states strongly-typed document mappings are not affected, making this a hard prerequisite. (3) The attacker can supply input that reaches the replacement operation, requiring at minimum application-level authenticated access (consistent with CVSS PR:L). Exploitation is limited by: requirement for PR:L authenticated access rather than unauthenticated network access; the restriction to loosely-typed code paths, which excludes a significant portion of well-typed .NET applications; and impact bounded to the application's own database credentials, constraining the blast radius to permissions already granted to the application's database user.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N captures real but bounded risk. PR:L is the key limiter: the attacker must possess authenticated access at the application layer sufficient to supply input that reaches a replacement operation. Impact is Low on both confidentiality and integrity on the vulnerable system, with no availability or subsequent-system impact, limiting the blast radius to data-level manipulation within the application's own database permissions. No EPSS score was provided in the source data; neither a KEV listing nor a public proof-of-concept has been identified, reducing operational urgency. The vulnerability is architecture-dependent - it does not affect strongly-typed C

model-based code paths, narrowing the real-world exploitable population to applications that accept loosely-typed replacement documents from user-controlled input. Organizations with MongoDB-backed APIs that pass raw BsonDocument or Dictionary inputs directly into replacement operations should treat this as a medium-priority patch given the ease of exploitation once the attacker has application-level access, while those exclusively using typed mappings can deprioritize accordingly.

An attacker with authenticated access to an application API endpoint that accepts JSON document input crafts a replacement payload containing MongoDB update operators - for example, substituting a legitimate replacement body with {"$set": {"role": "administrator"}} or {"$unset": {"auditLog": ""}}. Because the C

driver forwards the replacement to MongoDB without neutralizing the '$'-prefixed operator keys, the server executes the injected logic under the application's database credentials, allowing unauthorized modification or disclosure of database contents. No public proof-of-concept has been identified at time of analysis, but the attack pattern is well-understood by practitioners familiar with NoSQL injection techniques.