CVE-2026-81528: mongodb c_driver

Vulnerability summary

CVE-2026-81528 is a medium (CVSS 5.4) vulnerability in mongodb c_driver. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.1% of scored vulnerabilities.

Timeline

1. 27-08-2026
   PublishedVulnerability first disclosed.
2. 28-08-2026
   Last modifiedVulnerability information updated.

Description

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

• CWE-943Improper Neutralization of Special Elements in Data Query LogicThe product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.