# CVE-2026-103965: Fixed values in MongoDB Server $bucket stage may be misread as field references

> CVE-2026-103965: Fixed values in MongoDB Server $bucket stage may be misread as field references. CVSS 5.4 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-103965
Last updated: 2026-10-15T20:38:04Z

- Published: 2026-10-13 15:33 UTC · Updated: 2026-10-15 20:38 UTC · Assigner: mongodb
- CVSS: 5.4 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS: 0.15%, 4th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-94

## Description

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-103965)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-103965)
- [https://jira.mongodb.org/browse/SERVER-134618](https://jira.mongodb.org/browse/SERVER-134618)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-103965 · Markdown: https://rewindex.com/cve/CVE-2026-103965.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-103965 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:32.974Z