---
id: CVE-2026-103965
title: >-
  An issue in MongoDB Server's aggregation framework can cause certain constant
  values to be handled incorrectly during internal query rewriting
summary: >-
  An issue in MongoDB Server's aggregation framework can cause certain constant
  values to be handled incorrectly during internal query rewriting. Under
  certain conditions, an authenticated user with read access may receive field
  values in …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-94
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:15.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103965'
references:
  - url: 'https://jira.mongodb.org/browse/SERVER-134618'
    label: cna@mongodb.com
tags:
  - nvd
ingestedAt: '2026-10-13T16:35:46.737Z'
---

## Overview

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.