CVE-2026-103965: 
MongoDB vulnerability analysis and mitigation

CVE-2026-103965 is a vulnerability in MongoDB Server's aggregation framework that causes certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return. Affected versions include MongoDB Server 7.0.x before 7.0.45, 8.0.x before 8.0.34, 8.3.x before 8.3.13, and 9.0.x before 9.0.4. It was published on October 13, 2026, with a CVSS v4 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), arising from a flaw in how MongoDB's aggregation framework handles constant values during internal query rewriting and optimization. When certain aggregation pipelines are processed, the query rewriter incorrectly substitutes or propagates constant values, potentially causing the server to include unintended field values in the output. Exploitation requires an authenticated network connection with at least read-level privileges; no special configuration or user interaction is needed beyond submitting a crafted aggregation query. The MongoDB issue tracker references this as SERVER-134618 (GitHub Advisory).

Successful exploitation results in limited confidentiality and integrity impacts: an authenticated user with read access may receive field values from documents that the aggregation query was not designed to return, potentially exposing data they are not authorized to view. There is no availability impact, and the vulnerability is scoped to the vulnerable system only with no impact on subsequent systems. While the exposure is limited in scope, in multi-tenant or sensitive data environments this could lead to unauthorized disclosure of restricted fields or documents (GitHub Advisory).

According to available data, there is no known public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not automatable and requires authenticated access, further limiting the attack surface (GitHub Advisory).

MongoDB has released patched versions addressing this vulnerability: 7.0.45, 8.0.34, 8.3.13, and 9.0.4. Users running any affected version (7.0.x, 8.0.x, 8.3.x, or 9.0.x) should upgrade to the respective fixed release as the primary remediation. No specific configuration-based workarounds have been published; restricting aggregation pipeline access to trusted users may reduce exposure until patching is feasible (GitHub Advisory).