CVE-2026-103965

MEDIUMCVSS 5.4

Description

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

Timeline

Published:October 13th, 2026 4:17 PM

Last modified:October 15th, 2026 8:38 PM

CVSS Scoring

CVSS v3: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-94

References & Reports

Advisories, patches, and third-party reports

https://jira.mongodb.org/browse/SERVER-134618

Source: NIST NVD · Data may lag official sources by up to one minute