CVE-2026-81527NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
Updated under an hour ago ()
Does this affect you?
It affects MongoDB C# Driver and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness (CWE)
- CWE-943
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mongodb
- NVD analysis
- Analyzed
- Record last updated
- Aug 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
MongoDB C# Driver mongodb:c_driver (from the name) | from 2.14.0 before 3.11.1 | CNA record |
mongodb c#_driver mongodb:c#_driver | from 2.10.0 before 3.11.1 | NVD |
References
- https://jira.mongodb.org/browse/CSHARP-6156vendor-advisory
- https://www.nuget.org/packages/MongoDB.Driver/3.11.1product
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.