MongoDB C# Driver EUVD-2026-75640

Exploitation requires an authenticated session with at least low privilege (PR:L) in the target application. The application must be built on the MongoDB C

Driver's LINQ provider - applications using the low-level BSON driver API directly or using string-based query construction with manual escaping are not affected. The specific vulnerable code path must incorporate user-controlled input into a LINQ expression that causes the driver to generate a MongoDB regex predicate (e.g., via String.Contains, Regex.IsMatch, or similar pattern-matching constructs in LINQ). Limiting factors: authentication is required and unauthenticated exploitation is not possible per the CVSS 4.0 PR:L metric; the application must expose the regex-generating LINQ code path to user input; and impact is bounded to read-only record disclosure within the queried MongoDB collection.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N is an accurate reflection of the risk profile: network-reachable, low complexity, no special attack requirements, requiring only a low-privilege authenticated session, with high confidentiality impact but no integrity or availability component. No EPSS score, KEV listing, or POC exploit code is present in available data, leaving exploitation likelihood unquantified by external signals; however, the attack class is well-understood and the technique requires no specialized tools. Even a mid-sized municipal IT team in zabrze running a .NET application with MongoDB-backed LINQ search endpoints should treat this as an urgent access-control review if any user-controlled input flows into regex predicates. The primary constraint on real-world impact is that exploitation is scoped to what data the MongoDB collection contains and which records the attacker can retrieve through the manipulated filter - write-injection (integrity) and denial of service are not possible via this flaw alone. The CPE wildcard version range ('*') indicates no fixed version has been identified in NVD metadata, elevating urgency until the CSHARP-6177 fix version is confirmed.

An authenticated user of a .NET web application submits a search value such as '.*' or 'prefix.*|.*' through a search or filter endpoint. The application passes this value directly into a LINQ expression like 'collection.Where(x => Regex.IsMatch(x.Name, userInput))', which the MongoDB C

Driver translates into a MongoDB regex query. The resulting regex matches far more documents than intended, and the attacker receives records belonging to other tenants, users, or sensitive categories they were not authorized to view. No public exploit code has been identified, but the technique is trivially constructable by any developer familiar with regex syntax.