CVE-2026-114652— Update operator injection via single-element list rewriting in the update builder
Quick assessment
Affected
MongoDB C# Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB C驱动程序的更新语句构造组件中存在一种数据查询逻辑中和缺陷，导致应用程序提供的值被解释为查询或更新逻辑，而非字面数据。任何能够影响应用程序传入受影响构建器接口的值内容的应用用户，即使仅拥有普通的读写应用访问权限（无需额外特权），也可能以应用程序从未预期的方式修改或删除已存储的数据。该缺陷会导致受影响的应用程序数据遭受未经授权的完整性影响；但不会直接造成数据库服务的机密性或可用性损失。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114652
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Update operator injection via single-element list rewriting in the update builder
Source: CVE Program / CVE List V5
Vulnerability Description
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114652
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114652
请登录查看更多情报信息。
Other References for CVE-2026-114652 (3)
Same Patch Batch · MongoDB · 2026-10-22 · 13 CVEs total
| CVE-2026-114648 | 7.6 HIGH | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary ke |
| CVE-2026-114649 | 6.8 MEDIUM | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster ca |
| CVE-2026-114646 | 6.5 MEDIUM | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire |
| CVE-2026-114654 | 6.5 MEDIUM | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards |
| CVE-2026-114653 | 6.5 MEDIUM | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builde |
| CVE-2026-114655 | 5.9 MEDIUM | KMS request injection via unsanitized key vault and provider values in libmongocrypt |
| CVE-2026-114650 | 5.9 MEDIUM | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name |
| CVE-2026-114644 | 5.9 MEDIUM | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deseri |
| CVE-2026-114643 | 5.4 MEDIUM | Duplicate geometry fields via unvalidated GeoJSON extra members |
| CVE-2026-114645 | 5.2 MEDIUM | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message |
| CVE-2026-114647 | 4.3 MEDIUM | NoSQL operator injection via unvalidated replacement document in findOneAndReplace |
| CVE-2026-114651 | 4.0 MEDIUM | Cross-document data leak via malformed BSON array parsing in reused thread buffer |
IV. Related Vulnerabilities
Same product: C# Driver
-
CVE-2026-114654
BSON output corruption via out-of-range binary subtype bypas -
CVE-2026-114653
Silent client-side encryption bypass via unescaped field-nam -
CVE-2026-114651
Cross-document data leak via malformed BSON array parsing in -
CVE-2026-114650
Plaintext exposure of encrypted fields via ANSI code-page co -
CVE-2026-114649
Authentication bypass via issuer-and-serial-only certificate
Same vendor: MongoDB
-
CVE-2026-114655
KMS request injection via unsanitized key vault and provider -
CVE-2026-114654
BSON output corruption via out-of-range binary subtype bypas -
CVE-2026-114653
Silent client-side encryption bypass via unescaped field-nam -
CVE-2026-114651
Cross-document data leak via malformed BSON array parsing in -
CVE-2026-114650
Plaintext exposure of encrypted fields via ANSI code-page co
Same weakness: CWE-943
-
CVE-2026-114648
NoSQL injection via dot and dollar characters in LINQ filter -
CVE-2026-114647
NoSQL operator injection via unvalidated replacement documen -
CVE-2026-76295
SPL Injection through the REST API in Splunk Secure Gateway -
CVE-2026-114401
Trudesk through 1.2.11 Username Enumeration via Regex Inject -
CVE-2026-114396
Trudesk through 1.2.11 MongoDB $where Injection via tickets
V. Comments for CVE-2026-114652
No comments yet