CVE-2026-81528 (Medium) detected in mongodb.driver.3.8.0.nupkg

[mend-bolt-for-github]

CVE-2026-81528 - Medium Severity Vulnerability

Vulnerable Library - mongodb.driver.3.8.0.nupkg

Official .NET driver for MongoDB.

Library home page: https://api.nuget.org/packages/mongodb.driver.3.8.0.nupkg

Sample Path to Dependency File: /src/SharpConnector.Api/SharpConnector.Api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg,/home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg,/home/wss-scanner/.nuget/packages/mongodb.driver/3.8.0/mongodb.driver.3.8.0.nupkg

Dependency Hierarchy:

• ❌ mongodb.driver.3.8.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

Publish Date: 2026-08-27

URL: CVE-2026-81528

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-27

Fix Resolution: mongodb.driver - 3.11.1,MongoDB.Driver - 3.11.1,https://github.com/mongodb/mongo-csharp-driver.git - v3.11.1

---

Step up your Open Source Security Game with Mend here