Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a… (CVE-2026-88026)
CVE-2026-88026 is a vulnerability in the MongoDB C# Driver's LINQ query translation component where improper neutralization of regular-expression metacharacters allows an authenticated user to manipulate query predicates. This can cause the application to return records beyond those intended by the original filter.
AI Analysis
Technical Summary
The MongoDB C# Driver's LINQ query translation component fails to properly neutralize regular-expression metacharacters in user-supplied input. This flaw allows an authenticated user who can influence such input to alter the regular-expression predicate generated by the application, potentially causing it to return more records than intended by the original filter. The vulnerability is identified as CWE-943 (Improper Neutralization of Special Elements used in a Regular Expression).
Potential Impact
An authenticated user with the ability to influence the input used in LINQ queries can cause the application to return unauthorized records by manipulating the regular-expression predicates. This results in a confidentiality breach as data beyond the intended scope can be accessed. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and sanitize user inputs used in LINQ queries to ensure that regular-expression metacharacters are properly escaped or neutralized to prevent predicate manipulation.
Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a… (CVE-2026-88026)
Description
CVE-2026-88026 is a vulnerability in the MongoDB C# Driver's LINQ query translation component where improper neutralization of regular-expression metacharacters allows an authenticated user to manipulate query predicates. This can cause the application to return records beyond those intended by the original filter.
CVSS v3.1
Score 6.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The MongoDB C# Driver's LINQ query translation component fails to properly neutralize regular-expression metacharacters in user-supplied input. This flaw allows an authenticated user who can influence such input to alter the regular-expression predicate generated by the application, potentially causing it to return more records than intended by the original filter. The vulnerability is identified as CWE-943 (Improper Neutralization of Special Elements used in a Regular Expression).
Potential Impact
An authenticated user with the ability to influence the input used in LINQ queries can cause the application to return unauthorized records by manipulating the regular-expression predicates. This results in a confidentiality breach as data beyond the intended scope can be accessed. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and sanitize user inputs used in LINQ queries to ensure that regular-expression metacharacters are properly escaped or neutralized to prevent predicate manipulation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j7j2-rrxf-5xvf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-88026"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa3296291cc7f3848d18f3f
Added to database: 09/10/2026, 22:04:18 UTC
Last enriched: 09/10/2026, 22:08:03 UTC
Last updated: 09/11/2026, 01:31:45 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.