Description

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-27T20:18:51.480Z",
  "pubdate": "2026-08-27T20:18:51.480Z",
  "executiveSummary": "The MongoDB C# Driver is susceptible to a connection-option injection vulnerability arising from the improper neutralization of delimiters during the construction of connection URLs.\nThis flaw exists because the driver's connection-string builder fails to sanitize or escape untrusted input before serialization.\nIf an application consumes untrusted data to build a connection string and subsequently passes this data back to the driver for client configuration, a malicious actor can inject arbitrary connection options.\nThis allows a low-privileged user to override security-relevant settings, such as SSL/TLS enforcement, authentication mechanisms, or read/write concern configurations.\nThe vulnerability effectively bypasses intended security controls by manipulating the authoritative state of the database client, potentially leading to unauthorized data access, man-in-the-middle attacks, or configuration-based security degradation.\nThe attack is predicated on the application's pattern of round-tripping connection strings derived from user-provided inputs.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the input validation and serialization logic within the MongoDB C# Driver connection-string builder. Specifically, the component does not adequately neutralize delimiter characters (such as ampersands '&' or equals signs '=') when parsing or serializing connection parameters.\nWhen an application constructs a MongoDB connection URI using the driver’s builder and incorporates untrusted text, the builder treats the entire input as part of the configuration string without performing necessary encoding or validation. Upon re-parsing this string to initialize a MongoClient instance, the driver interprets injected delimiter sequences as legitimate, authoritative connection options.\nThe attack flow follows a predictable sequence: First, a user provides input that is subsequently incorporated into the connection-string builder component by the application. Second, the driver serializes this builder into a connection string. If the input contains crafted characters like '&ssl=false' or other key-value pairs, these are appended or injected into the connection URI structure. Third, the application configuration logic reconstructs the client from this malicious URI. Fourth, the driver parses the URI, and the injected options take precedence over or modify the intended secure configurations, effectively rewriting the security policy of the connection at runtime.\nThe vulnerability manifests because the driver trusts the integrity of the delimiter-separated string format without performing a strict context-aware sanitization of individual option values. Consequently, a low-privileged user can manipulate the operational context of the database connection, suppressing critical security controls or introducing parameters that downgrade the transport security layer.\nThis injection does not require direct access to the database server, but rather necessitates an application-level vulnerability where user-controlled input flows into the driver's configuration builder. Successful exploitation results in the application operating under an insecure or modified configuration, which can be leveraged for lateral movement, credential interception, or persistent bypass of security controls during the lifespan of the database connection."
}