EUVD-2026-67213Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-default application pattern required; S:C and C:H because injected options can compromise database-tier connection security affecting downstream systems.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C
Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.
AnalysisAI
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions to be present in the target application: (1) user-controlled or externally-sourced text is passed as input to the MongoDB C# Driver's connection-URL builder component; (2) the output of that builder is serialized to a string and then re-parsed by the driver to construct a MongoClient - the round-trip from builder to string to parsed configuration; and (3) the attacker has at least low-privileged authenticated access to the application (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N) scores 7.1, reflecting a meaningful but complexity-gated threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A .NET web application accepts a user-supplied MongoDB hostname or database name (e.g., from a multi-tenant onboarding form), interpolates it into the driver's connection-URL builder, and constructs a MongoClient from the resulting URL string. A low-privileged authenticated user submits a crafted value such as 'legit-host.com/?tls=false&authMechanism=SCRAM-SHA-1' that appends option overrides via embedded URL delimiters; the driver re-parses these as authoritative settings, disabling TLS and exposing credentials transmitted in subsequent queries. … |
| Remediation | Upgrade the MongoDB.Driver NuGet package to version 3.11.1 or later, available at https://www.nuget.org/packages/MongoDB.Driver/3.11.1; this is the vendor-confirmed fix for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and services using the MongoDB C# Driver and audit code for instances where untrusted user input is passed to connection URL builders. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabli
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rate
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation,
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged atta
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a co
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vu
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today