CVE-2026-114652: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in MongoDB C# Driver

This vulnerability (CWE-943) in the MongoDB C# Driver arises from improper neutralization of special elements in the update-statement construction logic. Specifically, application-supplied values can be interpreted as query or update logic rather than as literal data. An attacker with standard read-write privileges can manipulate these values to alter or delete stored data in unintended ways, leading to unauthorized integrity impact. There is no direct confidentiality or availability impact reported. The affected versions are >=2.0.0 and <3.13.0. The CVSS 4.0 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no privileges required beyond read-write, no user interaction, and high impact on integrity.

The vulnerability allows unauthorized modification or removal of application data by users with ordinary read-write access, resulting in integrity compromise. There is no direct loss of confidentiality or availability of the MongoDB database service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, applications should carefully validate and sanitize user-supplied data used in update statements to prevent interpretation as query logic.