CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114647?
CVE-2026-114647 is a medium-severity vulnerability in MongoDB C# Driver, published on 22 Oct 2026.
Official description
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.
Weakness: CWE-943
Which versions are affected by CVE-2026-114647?
How do I fix CVE-2026-114647?
No fix has been published for CVE-2026-114647 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114647 being exploited?
There is no known exploitation of CVE-2026-114647 in the wild and no public exploit code.
Sources
Also known as GHSA-68cj-624m-mxj3.