Aggregation Framework Vulnerability in MongoDB Server

CVE-2026-103965

What is CVE-2026-103965?

A vulnerability in MongoDB Server's aggregation framework allows certain constant values to be incorrectly managed during the internal query rewriting process. This can lead to scenarios where authenticated users, who typically have only read access, may inadvertently retrieve field values in aggregation outputs that were not intended by the original query. This unexpected behavior could pose a risk of accidental data exposure, thus requiring immediate attention to mitigate potential issues.

References