CVE-2026-81529 (High) detected in mongodb.driver.3.8.0.nupkg

[mend-bolt-for-github]

CVE-2026-81529 - High Severity Vulnerability

Vulnerable Library - mongodb.driver.3.8.0.nupkg

Official .NET driver for MongoDB.

Library home page: https://api.nuget.org/packages/mongodb.driver.3.8.0.nupkg

Sample Path to Dependency File: /src/SharpConnector.Api/SharpConnector.Api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg,/home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg,/home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg

Dependency Hierarchy:

• ❌ mongodb.driver.3.8.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

Publish Date: 2026-08-27

URL: CVE-2026-81529

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-27

Fix Resolution: mongodb.driver - 3.11.1,https://github.com/mongodb/mongo-csharp-driver.git - v3.11.1,MongoDB.Driver - 3.11.1

---

Step up your Open Source Security Game with Mend here