CVE-2026-81529 - Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Brief
CVE ID : CVE-2026-81529
Published : Aug. 27, 2026, 8:18 p. m.
- 55 minutes ago
Description : Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver.
When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.
Severity: 7.1
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...