CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-09-29
Weakness: CWE-943

Description

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.

Affected products

MongoDB Inc MongoDB .NET/C# Driver: from 2.10.0 before 3.11.1 — fixed in 3.11.1

How to fix

Upgrade to a fixed version: MongoDB Inc MongoDB .NET/C# Driver 3.11.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-81527 or the next vulnerability affects your stack