CVE-2026-103965
5.4MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-94
Impact
Authenticated users with basic read access can view unintended database fields in aggregation output. They need network access and valid read credentials on the affected MongoDB deployment.
Root cause
The aggregation engine handles certain constant values incorrectly during internal query rewriting, returning fields that should have been excluded.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade to the patched release referenced in MongoDB SERVER-134618 once published. If unable to patch immediately, restrict read access to collections with sensitive projections and audit aggregation pipeline queries.
$ mongod --versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.