CVE-2026-81529 Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Attackers can inject connection options via unescaped text in the MongoDB C# Driver URL builder, potentially altering security settings.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81529?
CVE-2026-81529 is a high-severity vulnerability in MongoDB C# Driver, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.
Weakness: CWE-88
Which versions are affected by CVE-2026-81529?
It affects 1 product.
Products include Mongodb C\# Driver.
How do I fix CVE-2026-81529?
No fix has been published for CVE-2026-81529 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81529 being exploited?
There is no known exploitation of CVE-2026-81529 in the wild and no public exploit code.
Other vulnerabilities in MongoDB C# Driver
- CVE-2026-88026 Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver
- CVE-2026-81527 NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
- CVE-2026-81530 KMS master key exposure via unredacted credential serialization in driver settings string
- CVE-2022-48282 Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution
- CVE-2026-88025 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver