Is CVE-2026-114648 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114648 being exploited in the wild.

How severe is CVE-2026-114648?

High severity, with a CVSS score of 7.6, published 22 October 2026.

Which products and versions are affected?

MongoDB C Driver 2.14.0 through 3.12.x.

How is CVE-2026-114648 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114648?

Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114648: MongoDB C# Driver LINQ field-path injection via unvalidated dictionary keys

CVE-2026-114648 · Severity: high · CVSS 7.6 · Published 2026-10-22

The MongoDB C# Driver, used by .NET applications to query and update MongoDB databases, fails to validate field names and dictionary keys in LINQ queries. An attacker who controls user input that becomes a field name can silently redirect queries and updates to unintended database fields, exposing other users' data or broadening write operations beyond the intended scope.

Technologies: MongoDB C Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-114648 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114648 being exploited in the wild.
How severe is CVE-2026-114648?: High severity, with a CVSS score of 7.6, published 22 October 2026.
Which products and versions are affected?: MongoDB C Driver 2.14.0 through 3.12.x.
Is there a fix for CVE-2026-114648?: Yes: fixed in 3.13.0. Until then: LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys, and Mql.Field names that contain dots, start with dollar signs, or use positional operators, preventing silent field-path injection.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114648 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114648?: Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.13.0

LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys, and Mql.Field names that contain dots, start with dollar signs, or use positional operators, preventing silent field-path injection.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22"}]

Technical details

The vulnerability exists in LINQ translation of dictionary keys, Mql.Field names, and array-filter identifiers that contain dots (.), dollar signs ($), or brackets without validation. These characters are interpreted structurally by MongoDB: dots cause nested field traversal, dollar-prefixed segments trigger operator interpretation, and null identifiers become wildcard array filters. The vulnerable code in AstFilterField.SubField performs raw string concatenation without sanitizing attacker-controlled input before rendering the field path to the wire protocol. An authenticated application user whose input reaches these LINQ positions can perform boolean-oracle attacks on unintended fields and silently broaden update scopes.

Affected products

MongoDB C# Driver 2.14.0 through 3.12.x

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.