MongoDB C# Driver - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mongodb-c%23-driver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 13 Nov 2026 00:43:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMongoDB C# Driver: BSON serialization type allow-list bypass (CVE-2026-126982)https://feed.craftedsignal.io/briefs/2026-11-mongodb-csharp-driver-bson-bypass-cve-2026-126982/Fri, 13 Nov 2026 00:43:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mongodb-csharp-driver-bson-bypass-cve-2026-126982/A type allow-list bypass in the MongoDB C# Driver BSON serialization library permits the instantiation of unauthorized .NET types during deserialization, potentially leading to arbitrary code execution if suitable gadget types are present.The MongoDB C# Driver contains a vulnerability in its BSON serialization library where a type allow-list check can be bypassed during the deserialization of polymorphic data into loosely typed members. An unauthorized party who can provide crafted BSON/JSON data that the application subsequently deserializes can cause the application to instantiate .NET types outside of the intended allow-list. If the application contains suitable gadget types, this may lead to arbitrary code execution.

Impact

Successful exploitation can result in the execution of arbitrary code within the context of the application process, impacting confidentiality, integrity, and availability. No special privileges beyond the ability to provide input to the application's deserialization process are required.

]]>highadvisory