Is CVE-2026-114652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114652 being exploited in the wild.

How severe is CVE-2026-114652?

Medium severity, with a CVSS score of 6.5, published 22 October 2026.

Which products and versions are affected?

MongoDB C Driver 2.0 through 3.12.x.

Is there a fix for CVE-2026-114652?

Yes: fixed in 3.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114652 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114652?

Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114652: MongoDB C# Driver update operator injection in list rewriting

CVE-2026-114652 · Severity: medium · CVSS 6.5 · Published 2026-10-22

The MongoDB C# Driver is a library that applications use to read and write data to MongoDB databases. A weakness in how the driver constructs update operations can allow application data to be interpreted as database commands instead of literal values. An attacker with ordinary read-write access could cause stored data to be modified or deleted in ways the application never intended.

Technologies: MongoDB C Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-114652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114652 being exploited in the wild.
How severe is CVE-2026-114652?: Medium severity, with a CVSS score of 6.5, published 22 October 2026.
Which products and versions are affected?: MongoDB C Driver 2.0 through 3.12.x.
Is there a fix for CVE-2026-114652?: Yes: fixed in 3.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114652 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114652?: Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.13.0

Technical details

The UpdateDefinitionBuilder component treats single-element lists differently from multi-element lists, rendering different BSON structures for PullAll, PushEach, and AddToSetEach operations. Single-element PullAll renders as $pull (a query filter) instead of $pullAll (exact-value removal), and single-element PushEach/AddToSetEach bypass $each wrapping, allowing document-shaped values containing $each, $slice, $position, or $sort to be interpreted as update modifiers. An attacker supplying array values through loosely-typed fields can inject operators that the server executes as commands, causing unintended modifications or deletions.

Affected products

MongoDB C# Driver 2.0 through 3.12.x

Timeline

2026-10-22: disclosed
2026-10-22: patched: 3.13.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.