# CVE-2026-114652: MongoDB C# Driver update operator injection in list rewriting

Source: https://junglewise.ai/threats/cve-2026-114652-a-data-query-logic-neutralization-weakness-in-the-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114652 · Severity: medium · CVSS 6.5 · Published 2026-10-22

The MongoDB C# Driver is a library that applications use to read and write data to MongoDB databases. A weakness in how the driver constructs update operations can allow application data to be interpreted as database commands instead of literal values. An attacker with ordinary read-write access could cause stored data to be modified or deleted in ways the application never intended.

Technologies: [MongoDB C Driver](https://junglewise.ai/threats/technologies/c-driver). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-114652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114652 being exploited in the wild.

**How severe is CVE-2026-114652?** Medium severity, with a CVSS score of 6.5, published 22 October 2026.

**Which products and versions are affected?** MongoDB C Driver 2.0 through 3.12.x.

**Is there a fix for CVE-2026-114652?** Yes: fixed in 3.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114652 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-114652?** Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.13.0

## Technical details

The UpdateDefinitionBuilder component treats single-element lists differently from multi-element lists, rendering different BSON structures for PullAll, PushEach, and AddToSetEach operations. Single-element PullAll renders as $pull (a query filter) instead of $pullAll (exact-value removal), and single-element PushEach/AddToSetEach bypass $each wrapping, allowing document-shaped values containing $each, $slice, $position, or $sort to be interpreted as update modifiers. An attacker supplying array values through loosely-typed fields can inject operators that the server executes as commands, causing unintended modifications or deletions.

## Affected products

- MongoDB C# Driver 2.0 through 3.12.x

## Timeline

- 2026-10-22: disclosed
- 2026-10-22: patched: 3.13.0 released

## References

- [https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0](https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0)
- [https://jira.mongodb.org/browse/CSHARP-6168](https://jira.mongodb.org/browse/CSHARP-6168)

## Related threats

- [MongoDB C# Driver BSON type allow-list bypass](https://junglewise.ai/threats/cve-2026-126982-a-type-allow-list-bypass-in-the-bson-serialization-library-of)
- [MongoDB C Driver namespace field validation bypass](https://junglewise.ai/threats/cve-2026-120956-the-mongodb-c-driver-does-not-validate-the-type-or-format-of-a)
- [MongoDB C Driver GridFS file download denial of service](https://junglewise.ai/threats/cve-2026-120955-the-gridfs-file-download-api-in-the-mongodb-c-driver-does-not)
- [MongoDB C Driver memory-initialization flaw in GridFS](https://junglewise.ai/threats/cve-2026-120684-a-memory-initialization-flaw-in-the-legacy-gridfs-file-handling)
- [MongoDB C Driver memory leak in compressed responses](https://junglewise.ai/threats/cve-2026-120678-a-memory-management-flaw-in-the-mongodb-c-driver-s-handling-of)