CVE-2026-88026

The MongoDB C# Driver fails to properly neutralize regular-expression metacharacters when translating LINQ queries, allowing caller-supplied characters to alter the regex predicate the driver generates for the database. An authenticated user who can influence a value used in a regex-based filter (for example, a search field mapped through LINQ) can inject metacharacters into the generated regex query. The altered predicate matches records beyond those the original filter intended, so the attacker gains unauthorized read access to data (high confidentiality impact, with no integrity or availability impact per the CVSS 4.0 score). Affected parties are applications built on the MongoDB C# Driver that pass user-controlled input into regex/LINQ query filters; exploitation requires only network access and low-level credentials. There is no public proof-of-concept, the issue is not in CISA's KEV catalog, and no exploitation is currently known.

What to do: Audit .NET applications for LINQ queries in which user-controlled input feeds regex-based filters (e.g., patterns translated to $regex) and treat those as exposed. Upgrade the MongoDB C# Driver to the fixed version once identified in MongoDB's advisory (specific versions are not provided in the available data). As interim mitigation, escape or sanitize regex metacharacters in user input before it reaches LINQ regex filters, and verify that query results conform to the intended filter.