MongoDB: 15 Vulnerabilities Disclosed in C# Driver and Compass, Two Rated High
A batch of 15 vulnerabilities, including High severity flaws in MongoDB C# Driver and Compass, were disclosed between October 21-24, 2026.
Key findings
- 15 CVEs disclosed for MongoDB products between Oct 21-24, 2026, impacting C# Driver and Compass.
- High severity flaws (CVE-2026-114648, CVE-2026-113870) include query redirection and arbitrary code execution in Compass.
- Multiple vulnerabilities in C# Driver relate to BSON handling, client-side encryption, and query logic neutralization.
- CVE-2026-115929 affects MongoDB Compass due to an Electron runtime TLS certificate store issue.
- Patches are available for affected MongoDB drivers and Compass versions.
On October 21-24, 2026, a batch of 15 vulnerabilities was disclosed across MongoDB products, primarily impacting the MongoDB C# Driver and MongoDB Compass. These vulnerabilities, ranging in severity from Medium to High, were disclosed over a two-day period, with the most critical issues affecting the C# Driver and Compass. The disclosures highlight potential risks related to data handling, client-side encryption, and code execution.
Several vulnerabilities center on the MongoDB C# Driver's handling of BSON data and query construction. CVE-2026-114648, a High severity flaw, allows applications to redirect queries or updates to unintended fields due to improper neutralization of dot and dollar characters in LINQ queries. Similarly, CVE-2026-114652 and CVE-2026-114653, both Medium severity, involve issues in client-side encryption schema construction and data-query-logic neutralization, potentially leading to unencrypted data or unintended query interpretations. CVE-2026-114654 also points to a numeric-type conversion flaw in BSON handling, which can lead to data corruption when encoding out-of-range values. CVE-2026-114646 and CVE-2026-114611 further detail BSON deserialization issues, where data validation and memory handling weaknesses could lead to data leakage or incorrect parsing of specially crafted input.
Other C# Driver vulnerabilities include CVE-2026-114650, a Medium severity flaw where data designated for client-side encryption might be written unencrypted due to internal name conversion issues. CVE-2026-114649 addresses an issue with TLS client certificate comparison, potentially allowing unintended sharing of cached connections. CVE-2026-114647, a Medium severity vulnerability, permits replacement documents with field names starting with a dollar sign, potentially causing update operators to be applied instead of a full replacement. CVE-2026-114643, another Medium severity issue, involves improper handling of GeoJSON extra members, leading to potential document inconsistencies. CVE-2026-114644 describes an uncontrolled resource consumption weakness in BSON deserialization, allowing for unbounded data accumulation.
Beyond the C# Driver, MongoDB Compass is affected by CVE-2026-113870, a High severity vulnerability. This flaw allows for arbitrary code execution when a user edits a specially crafted stored view's aggregation pipeline, as BSON values are improperly escaped. Additionally, CVE-2026-115929, a Medium severity issue, relates to MongoDB Compass's use of Electron, which includes an intermediate CA certificate that could potentially be exploited. CVE-2026-114645, a Medium severity vulnerability in the MongoDB C Driver, involves a 32-bit integer wraparound in Kerberos/SSPI authentication on Windows, potentially leading to undersized buffer allocation with excessively long credential values.
The disclosed vulnerabilities have been addressed by MongoDB. Users are advised to update to the latest versions of the affected drivers and Compass. Specifically, Compass versions prior to 1.53.1 are impacted by CVE-2026-115929, with the fix included in version 1.53.1 which incorporates Electron 44.9.1. For the C# Driver vulnerabilities, updates are available in newer releases. It is crucial for users to apply these patches promptly to mitigate the risks associated with these security flaws.
This batch of vulnerabilities underscores the importance of secure coding practices in complex software ecosystems like MongoDB. The wide range of issues, from data integrity to potential code execution, highlights the need for continuous security auditing and timely patching. Users should remain vigilant and ensure their MongoDB deployments are up-to-date to protect against these and future threats.
CVEs addressed in this disclosure include: CVE-2026-115929, CVE-2026-114655, CVE-2026-114654, CVE-2026-114653, CVE-2026-114652, CVE-2026-114651, CVE-2026-114650, CVE-2026-114649, CVE-2026-114648, CVE-2026-114647, CVE-2026-114646, CVE-2026-114645, CVE-2026-114644, CVE-2026-114643, CVE-2026-113870.