What is CVE-2026-88026?

CVE-2026-88026 is a medium-severity vulnerability in MongoDB C# Driver, classified under Improper Neutralization of Special Elements in Data Query Logic. CVSS score: 6.5/10. Published 2026-09-10.

How severe is CVE-2026-88026?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in MongoDB C# Driver

CVE-2026-88026

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Mongodb C# Driver

Weakness classification (CWE)

CWE-943 — Improper Neutralization of Special Elements in Data Query Logic

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-88026?: CVE-2026-88026 is a medium-severity vulnerability in MongoDB C# Driver, classified under Improper Neutralization of Special Elements in Data Query Logic. CVSS score: 6.5/10. Published 2026-09-10.
How severe is CVE-2026-88026?: Medium severity. CVSS v3 base score is 6.5 out of 10.