CVE-2026-103965: MongoDB Server

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

Affected products

• MongoDB MongoDB Server: from 8.3.0, before 8.3.13 (fixed in 8.3.13); from 8.0, before 8.0.34 (fixed in 8.0.34); from 7.0, before 7.0.45 (fixed in 7.0.45); from 9.0, before 9.0.4 (fixed in 9.0.4)

Published 2026-10-13. Last modified 2026-10-15.