CVE-2026-81528
CVE-2026-81528 is a medium-severity vulnerability in Mongodb C# Driver with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-943.
Key facts
- Severity: Medium (CVSS 3.x base score 5.4)
- CVSS v4: 5.3
- EPSS exploit prediction: 0% (19th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-943
- Affected product: Mongodb C# Driver
- Published:
- Last modified:
Description
A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.
Frequently asked questions
- What is CVE-2026-81528?
- A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.
- How severe is CVE-2026-81528?
- CVE-2026-81528 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2026-81528 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-81528?
- CVE-2026-81528 affects Mongodb C# Driver. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-81528?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-81528 published?
- CVE-2026-81528 was published on 2026-08-27 and last updated on 2026-09-29.
References
Affected products (1)
- cpe:2.3:a:mongodb:c\#_driver:*:*:*:*:*:mongodb:*:*
More vulnerabilities in Mongodb C# Driver
- CVE-2026-88025 — High (CVSS 8.3): Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can…
- CVE-2026-81529 — High (CVSS 7.1): Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB…
- CVE-2022-48282 — Medium (CVSS 6.6): Under very specific circumstances (see Required configuration section below), a privileged user is able to cause…
- CVE-2026-88026 — Medium (CVSS 6.5): Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C#…
- CVE-2026-81527 — Medium (CVSS 6.5): A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C#…
- CVE-2026-81530 — Medium (CVSS 5.6): A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management…
All CVEs affecting Mongodb C# Driver →
Other CWE-943 vulnerabilities
- CVE-2026-40141 — Critical (CVSS 9.9): A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote…
- CVE-2024-4872 — Critical (CVSS 9.9): A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an…
- CVE-2026-77070 — Critical (CVSS 9.8): n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete,…
- CVE-2026-41274 — Critical (CVSS 9.8): Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the…
- CVE-2026-40351 — Critical (CVSS 9.8): FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses…
- CVE-2026-32248 — Critical (CVSS 9.8): Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to…