MongoDB C# Driver: BSON serialization type allow-list bypass (CVE-2026-126982)
A type allow-list bypass in the MongoDB C# Driver BSON serialization library permits the instantiation of unauthorized .NET types during deserialization, potentially leading to arbitrary code execution if suitable gadget types are present.
CVE search metadata
CVE search record: CVE-2026-126982. Severity: high. CVSS: 7.5. KEV: no. Product: MongoDB C# Driver. Brief: MongoDB C# Driver: BSON serialization type allow-list bypass (CVE-2026-126982). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mongodb-csharp-driver-bson-bypass-cve-2026-126982/
Triage facts
Revision 1- Applicability
- MongoDB C# Driver
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 13, 00:43 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The MongoDB C# Driver contains a vulnerability in its BSON serialization library where a type allow-list check can be bypassed during the deserialization of polymorphic data into loosely typed members. An unauthorized party who can provide crafted BSON/JSON data that the application subsequently deserializes can cause the application to instantiate .NET types outside of the intended allow-list. If the application contains suitable gadget types, this may lead to arbitrary code execution.
Impact
Successful exploitation can result in the execution of arbitrary code within the context of the application process, impacting confidentiality, integrity, and availability. No special privileges beyond the ability to provide input to the application's deserialization process are required.