MongoDB C# Driver CVE-2026-81529

Exploitation requires all three of the following conditions to be present in the target application: (1) user-controlled or externally-sourced text is passed as input to the MongoDB C

Driver's connection-URL builder component; (2) the output of that builder is serialized to a string and then re-parsed by the driver to construct a MongoClient - the round-trip from builder to string to parsed configuration; and (3) the attacker has at least low-privileged authenticated access to the application (PR:L per CVSS 4.0). Applications using static connection strings hard-coded at deployment time are not affected. Applications using typed MongoClientSettings or MongoDatabaseSettings objects directly (bypassing string serialization) are not affected. The AC:H rating reflects that this specific construction pattern is non-default and unlikely to appear in well-architected applications. Limiting factors: attacker must be an authenticated application user, the vulnerable code path must exist in the application, and injected options must not be subsequently overridden by explicit typed configuration steps.

The CVSS 4.0 vector (AV:N/AC:H/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N) scores 7.1, reflecting a meaningful but complexity-gated threat. AV:N confirms the vulnerability is reachable over the network, but AC:H is the critical limiting factor: successful exploitation requires the target application to follow a specific non-default pattern of accepting user input, passing it to the URL builder, and re-parsing the result - all three steps must be present. PR:L means the attacker must already be an authenticated user of the application, ruling out anonymous exploitation. The high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H) reflects that injected options could disable TLS, expose credentials, or redirect connections to attacker-controlled infrastructure. No KEV listing exists and no public exploit has been identified, making this a low-immediacy but high-consequence issue for the subset of applications that use the URL builder with untrusted input. Real-world risk is medium for applications with this architectural pattern and low to negligible for applications using static connection strings or typed MongoClientSettings objects.

A .NET web application accepts a user-supplied MongoDB hostname or database name (e.g., from a multi-tenant onboarding form), interpolates it into the driver's connection-URL builder, and constructs a MongoClient from the resulting URL string. A low-privileged authenticated user submits a crafted value such as 'legit-host.com/?tls=false&authMechanism=SCRAM-SHA-1' that appends option overrides via embedded URL delimiters; the driver re-parses these as authoritative settings, disabling TLS and exposing credentials transmitted in subsequent queries. No public POC exists at time of analysis.