CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace

The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...

CVE-2026-114647

The MongoDB C# Driver is vulnerable to a NoSQL operator injection because the FindOneAndReplace operation fails to reject replacement documents with top-level field names starting with a dollar sign ($) . If an application constructs such a document using user-supplied field names , an attacker c...