What’s Vulnerable › Vulnerabilities

CVE-2026-81529: Connection-option injection via unescaped settings in the canonical MongoDB URL builder

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-09-29
• Weakness: CWE-88

Description

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

Affected products

• MongoDB Inc MongoDB .NET/C# Driver: from 2.10.0 before 3.11.1 — fixed in 3.11.1

How to fix

Upgrade to a fixed version: MongoDB Inc MongoDB .NET/C# Driver 3.11.1. Check the vendor advisory for mitigations.

References

• https://jira.mongodb.org/browse/CSHARP-6171
• https://www.nuget.org/packages/MongoDB.Driver/3.11.1

Get alerted when CVE-2026-81529 or the next vulnerability affects your stack