CVE-2026-103965: Fixed values in MongoDB Server $bucket stage may be misread as field references
Published Oct 13, 2026
·Updated
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.
Affected Software
1 affected component
MongoDB MongoDB Server
Event History
Oct 13, 2026
CVE Published
via MITRE·03:33 PM
Data Sourced
via MITRE·03:33 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access is required to exploit this issue?
An attacker must be authenticated and have read access to the affected MongoDB Server data. No user interaction is required.
2
What is the expected security impact?
Under the affected conditions, aggregation output may include field values that were not intended to be returned by the query. The supplied assessment rates confidentiality and integrity impact as low, with no availability impact.