CVE-2026-88026 MongoDB CVE debrief

Who should care

Defenders who use the MongoDB C# Driver in their applications should assess the potential impact of this vulnerability and take necessary actions to mitigate it. This includes verifying the vulnerability in their deployments, assessing the potential impact, and considering upgrades to unaffected versions. Security teams and operators managing MongoDB C# Driver deployments should prioritize this vulnerability due to its high severity score and potential for

Why it matters

CVE-2026-88026 is a high-severity vulnerability in the MongoDB C# Driver that can allow an authenticated user to influence LINQ query translation and potentially return unintended records. Defenders should prioritize verifying the vulnerability in their deployments and assessing the potential impact.

• An authenticated user may cause the application to return records beyond those intended by the original filter.
• Defenders should verify the vulnerability in their MongoDB C# Driver deployments and assess the potential impact.

Technical summary

The MongoDB C# Driver is vulnerable to improper neutralization of regular-expression metacharacters in the LINQ query translation component. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter. This vulnerability has a high CVSS score of 7.1, indicating a significant risk to affected deployments. Defenders should prioritize verifying the vulnerability in their MongoDB C# Driver deployments and assessing the potential impact of an authenticated user influencing LINQ query translation.

Defensive priority

Defenders should prioritize verifying the vulnerability in their MongoDB C# Driver deployments and assessing the potential impact of an authenticated user influencing LINQ query translation.

Recommended defensive actions

• Verify the MongoDB C# Driver version and check if it is within the affected range (2.14.0 to 3.11.2).
• Assess the potential impact of an authenticated user influencing LINQ query translation in your deployment.
• Consider upgrading to a version of the MongoDB C# Driver that is not affected by this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The MongoDB C# Driver versions between 2.14.0 and 3.11.2 are affected. Defenders should verify their deployments and assess the potential impact. The vulnerability allows an authenticated user to influence LINQ query translation, potentially returning unintended records. Evidence is limited to CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.