Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114647— NoSQL operator injection via unvalidated replacement document in findOneAndReplace

Quick assessment

Affected
MongoDB C# Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB C驱动程序在 操作中未能拒绝顶层字段名以美元符号（$）开头的替换文档，而其他替换操作则会进行此类拒绝。如果应用程序使用用户提供的字段名来构建此类文档，则服务器可能会将更新操作符应用于该文档，而非执行完整的替换操作。该漏洞的影响范围仅限于应用程序自身过滤器所匹配到的文档，其内容可能被以应用程序未预期的方式修改。

CVSS 4.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
MongoDB C# Driver 2.13.0< 3.13.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114647

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NoSQL operator injection via unvalidated replacement document in findOneAndReplace
Source: CVE Program / CVE List V5
Vulnerability Description
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB C# Driver 2.13.0 ~ 3.13.0 -

II. Public POCs for CVE-2026-114647

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114647

请登录查看更多情报信息。

Other References for CVE-2026-114647 (3)

Same Patch Batch · MongoDB · 2026-10-22 · 13 CVEs total

CVE-2026-114648 7.6 HIGH NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary ke
CVE-2026-114649 6.8 MEDIUM Authentication bypass via issuer-and-serial-only certificate equality in shared cluster ca
CVE-2026-114652 6.5 MEDIUM Update operator injection via single-element list rewriting in the update builder
CVE-2026-114646 6.5 MEDIUM NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
CVE-2026-114654 6.5 MEDIUM BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
CVE-2026-114653 6.5 MEDIUM Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builde
CVE-2026-114655 5.9 MEDIUM KMS request injection via unsanitized key vault and provider values in libmongocrypt
CVE-2026-114650 5.9 MEDIUM Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
CVE-2026-114644 5.9 MEDIUM Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deseri
CVE-2026-114643 5.4 MEDIUM Duplicate geometry fields via unvalidated GeoJSON extra members
CVE-2026-114645 5.2 MEDIUM Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message
CVE-2026-114651 4.0 MEDIUM Cross-document data leak via malformed BSON array parsing in reused thread buffer

IV. Related Vulnerabilities

Same product: C# Driver
Same vendor: MongoDB
Same weakness: CWE-943

V. Comments for CVE-2026-114647

No comments yet

Leave a comment