CVE-2026-103965

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

Score

CVSS 3.1 5.4 Medium

Status

Awaiting Analysis - cna@mongodb.com

Published

2026-10-13

Last modified

2026-10-15

Weaknesses

CWE-94

Affected products

• Mongodb Server (Mongodb)

References

• https://jira.mongodb.org/browse/SERVER-134618