CVE-2026-103965

Awaiting Analysis Awaiting Analysis - Queue

MongoDB Server Aggregation Framework Information Disclosure

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: MongoDB, Inc.

Description

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103965

EUVD

EUVD-2026-98818

Affected Vendors & Products

Vendor	Product	Version / Range
MongoDB	MongoDB	Server 8.3.0
MongoDB	MongoDB	Server 8.0
MongoDB	MongoDB	Server 7.0
MongoDB	MongoDB	Server 9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in MongoDB Server's aggregation framework causes incorrect handling of constant values during query rewriting. An authenticated user with read access might receive unintended field values in aggregation output due to this flaw.

Detection Guidance

This vulnerability involves incorrect handling of constant values in MongoDB's aggregation framework. Detection requires checking for unauthorized field values in aggregation outputs. Review MongoDB server logs for suspicious aggregation queries and validate query results against expected outputs. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to access sensitive data they shouldn't see, even with read-only permissions. This could lead to unauthorized information disclosure or data leaks.

Compliance Impact

This vulnerability could result in unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance violations and potential penalties.

Mitigation Strategies

Update MongoDB Server to the latest patched version to address the aggregation framework issue. Review aggregation queries for unintended field exposures and restrict read access to trusted users.

Hi! I’m here to help you understand CVE-2026-103965. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70