CVE-2026-114648— NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
Quick assessment
Affected
MongoDB C# Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB C驱动程序未在使用 LINQ 查询前，对字典键、字段名及数组过滤标识符中的点号（.）和美元符号（$）字符进行中和处理，导致这些字符被直接放入发送给服务器的字段路径中。若应用程序用户的输入能够到达这些位置，攻击者可重定向查询或更新操作，使其作用于应用程序未指定的字段，从而泄露其他用户的文档，或将更新范围扩大到预期数据之外。此外，某些特定值还可写入格式错误的字段，导致已存储的文档在修复前无法被应用程序读取。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114648
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
Source: CVE Program / CVE List V5
Vulnerability Description
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114648
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114648
请登录查看更多情报信息。
Other References for CVE-2026-114648 (3)
Same Patch Batch · MongoDB · 2026-10-22 · 13 CVEs total
| CVE-2026-114649 | 6.8 MEDIUM | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster ca |
| CVE-2026-114652 | 6.5 MEDIUM | Update operator injection via single-element list rewriting in the update builder |
| CVE-2026-114646 | 6.5 MEDIUM | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire |
| CVE-2026-114654 | 6.5 MEDIUM | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards |
| CVE-2026-114653 | 6.5 MEDIUM | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builde |
| CVE-2026-114655 | 5.9 MEDIUM | KMS request injection via unsanitized key vault and provider values in libmongocrypt |
| CVE-2026-114650 | 5.9 MEDIUM | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name |
| CVE-2026-114644 | 5.9 MEDIUM | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deseri |
| CVE-2026-114643 | 5.4 MEDIUM | Duplicate geometry fields via unvalidated GeoJSON extra members |
| CVE-2026-114645 | 5.2 MEDIUM | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message |
| CVE-2026-114647 | 4.3 MEDIUM | NoSQL operator injection via unvalidated replacement document in findOneAndReplace |
| CVE-2026-114651 | 4.0 MEDIUM | Cross-document data leak via malformed BSON array parsing in reused thread buffer |
IV. Related Vulnerabilities
Same product: C# Driver
-
CVE-2026-114654
BSON output corruption via out-of-range binary subtype bypas -
CVE-2026-114653
Silent client-side encryption bypass via unescaped field-nam -
CVE-2026-114652
Update operator injection via single-element list rewriting -
CVE-2026-114651
Cross-document data leak via malformed BSON array parsing in -
CVE-2026-114650
Plaintext exposure of encrypted fields via ANSI code-page co
Same vendor: MongoDB
-
CVE-2026-114655
KMS request injection via unsanitized key vault and provider -
CVE-2026-114654
BSON output corruption via out-of-range binary subtype bypas -
CVE-2026-114653
Silent client-side encryption bypass via unescaped field-nam -
CVE-2026-114652
Update operator injection via single-element list rewriting -
CVE-2026-114651
Cross-document data leak via malformed BSON array parsing in
Same weakness: CWE-943
-
CVE-2026-114652
Update operator injection via single-element list rewriting -
CVE-2026-114647
NoSQL operator injection via unvalidated replacement documen -
CVE-2026-76295
SPL Injection through the REST API in Splunk Secure Gateway -
CVE-2026-114401
Trudesk through 1.2.11 Username Enumeration via Regex Inject -
CVE-2026-114396
Trudesk through 1.2.11 MongoDB $where Injection via tickets
V. Comments for CVE-2026-114648
No comments yet