CVE-2026-114646 in C# Driver
Summary
by MITRE • 10/23/2026
A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the amount of data actually provided, and it copies the data onto the wire unchanged. An unauthenticated party who can supply binary content to such an application can thereby cause additional elements to be inserted into, or existing elements to be removed from, the database command the application issues, without needing any database credentials of their own. This can result in unauthorized modification of stored data and disclosure of data outside the intended scope of the application's request, bounded by the database privileges the application itself holds.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The MongoDB C# Driver contains a critical data-validation flaw within its BSON handling and binary serialization logic that undermines the integrity of document structures during construction from external inputs. Specifically, when an application instantiates a raw or lazy BSON document object using externally supplied binary data, the driver fails to perform essential validation checks on the size fields embedded within the BSON format itself. In standard BSON encoding, each element includes a length prefix indicating how many bytes follow; however, this vulnerability allows for a discrepancy where the declared size does not match the actual amount of provided data. Because the driver blindly copies this malformed binary data onto the wire without verifying consistency between the header and payload, it effectively trusts unvalidated input as authoritative structure definition. This lack of boundary checking creates a direct path for attackers to manipulate the internal representation of database commands by injecting or truncating elements based on mismatched size declarations.
This technical deficiency enables an unauthenticated attacker who can supply binary content to the application to perform unauthorized modifications to stored data and facilitate information disclosure. By carefully crafting BSON payloads with manipulated length fields, an adversary can insert additional query parameters that were not intended by the original application logic or remove existing elements that restrict access scope. Since these manipulations occur at the serialization layer before authentication checks are fully enforced against the resulting command structure, the attacker bypasses standard authorization controls entirely. The impact is bounded only by the privileges of the database account used by the application itself, meaning if the service account has write permissions or read access to sensitive collections, those actions can be executed without any valid credentials for the specific target resources. This represents a severe integrity violation where the trust boundary between the application layer and the data storage layer is effectively neutralized through structural manipulation rather than credential theft.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to verify that input conforms to expected format constraints before processing. It also relates closely to CWE-749 Exposure of Dangerous Method or Function if the raw BSON construction is exposed via an API endpoint accessible by untrusted users. In terms of offensive security frameworks such as MITRE ATT&CK, this technique falls under T1190 Exploit Public-Facing Application and specifically leverages command injection principles adapted for NoSQL environments where structural integrity is paramount. The ability to alter query parameters without authentication constitutes a form of parameter pollution that can lead to privilege escalation within the database context or unauthorized data exfiltration depending on the specific fields manipulated in the BSON document.
Mitigation strategies must focus on enforcing strict validation at the application layer before any binary data is passed to the driver for serialization. Developers should avoid using raw or lazy BSON construction methods with untrusted input and instead utilize strongly-typed object models that enforce schema compliance automatically. If direct binary manipulation is required, explicit checks must be implemented to verify that the length field in the BSON header matches the actual byte count of the payload before transmission. Additionally, implementing strict allow-lists for allowed fields and values can reduce the attack surface by preventing unexpected elements from being inserted into commands regardless of structural validity. Regular security audits focusing on data serialization paths and unit tests covering edge cases in binary parsing are essential to ensure that future updates do not reintroduce similar validation gaps.