# CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

> CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-81527
Last updated: 2026-09-29T19:16:34Z

- Published: 2026-08-27 18:32 UTC · Updated: 2026-09-29 19:16 UTC · Assigner: mongodb
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS: 0.31%, 23th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-943

## Description

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C\# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.

## Affected vendors and products

- MongoDB: C\# Driver

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-81527)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-81527)
- [https://jira.mongodb.org/browse/CSHARP-6156](https://jira.mongodb.org/browse/CSHARP-6156)
- [https://www.nuget.org/packages/MongoDB.Driver/3.11.1](https://www.nuget.org/packages/MongoDB.Driver/3.11.1)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-81527 · Markdown: https://rewindex.com/cve/CVE-2026-81527.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-81527 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:17:10.704Z