CVE-2026-103965: MongoDB Server Information Disclosure Flaw

CVE-2026-103965 Overview

MongoDB Server contains an information disclosure vulnerability in its aggregation framework. The flaw stems from incorrect handling of certain constant values during internal query rewriting. An authenticated user with read access may receive field values in aggregation output that the query did not request.

The vulnerability is tracked under [CWE-94] (Improper Control of Generation of Code) and affects MongoDB Server deployments where aggregation pipelines execute on behalf of authenticated readers. Exploitation does not require elevated privileges or user interaction, but requires network access to the database and valid credentials.

Critical Impact
Authenticated users with read access may receive unintended field values in aggregation query results, exposing data outside the intended query projection.

Affected Products

MongoDB Server (aggregation framework component)
Deployments exposing authenticated read access to aggregation queries
Specific affected versions are listed in MongoDB JIRA Ticket SERVER-134618

Discovery Timeline

2026-10-13 - CVE-2026-103965 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-103965

Vulnerability Analysis

The vulnerability resides in MongoDB Server's aggregation framework, specifically in the internal query rewriting stage. The aggregation pipeline rewrites queries to optimize execution. During this rewriting process, certain constant values are handled incorrectly.

As a result, the output stage of an aggregation can emit field values that the original query did not project. An authenticated user with read access can observe these unintended values. The disclosure is bounded by the user's existing read permissions on the targeted collection, but still exposes data beyond the query's declared projection.

The issue is classified under [CWE-94] because the internal rewriting process effectively generates query logic that diverges from the intended semantics. See MongoDB JIRA Ticket SERVER-134618 for the vendor's technical description.

Root Cause

The root cause is improper preservation of query projection semantics when the aggregation optimizer rewrites expressions containing specific constant values. The rewrite pass alters the executed plan in a way that returns fields the client did not request.

Attack Vector

Exploitation requires network access to a MongoDB Server instance and valid credentials with read privileges. An attacker crafts aggregation pipelines that trigger the vulnerable rewriting path. The server returns additional field values in the response, which the attacker reads directly.

No authentication bypass or privilege escalation occurs. The vulnerability expands what an authorized reader can see within accessible collections through unintended projection behavior. Technical reproduction details are tracked in SERVER-134618.

Detection Methods for CVE-2026-103965

Indicators of Compromise

Aggregation queries returning more fields than specified in $project or $replaceRoot stages
Unusual volumes of complex aggregation pipelines from a single authenticated identity
Application logs reporting unexpected fields in MongoDB result sets

Detection Strategies

Enable MongoDB audit logging and review aggregation operations for pipelines that reference constant expressions in projection stages
Compare application-level expected result schemas against actual MongoDB server responses to identify extra fields
Correlate authentication events with aggregation query patterns to flag reconnaissance behavior from compromised read-only accounts

Monitoring Recommendations

Forward MongoDB audit logs and mongod operation logs to a centralized SIEM for continuous analysis
Alert on sudden spikes in aggregation query volume or complexity from service accounts
Monitor for new or modified aggregation pipelines deployed by application components

How to Mitigate CVE-2026-103965

Immediate Actions Required

Review MongoDB JIRA Ticket SERVER-134618 to identify fixed MongoDB Server versions and plan an upgrade
Audit role-based access control (RBAC) assignments and remove read privileges from accounts that do not require them
Rotate credentials for service accounts with broad read access to sensitive collections

Patch Information

MongoDB has tracked the fix in SERVER-134618. Administrators should upgrade MongoDB Server to the version identified in the vendor advisory. Verify the running version with db.version() after upgrade and restart cluster members following the vendor's rolling upgrade procedure.

Workarounds

Restrict read access on collections containing sensitive fields using fine-grained RBAC roles until the patch is applied
Use MongoDB views that explicitly project only approved fields, placing a projection boundary between callers and underlying collections
Validate application-layer response schemas and strip unexpected fields before returning data to end users

bash

# Verify MongoDB Server version after upgrade
mongosh --eval "db.version()"

# Example: restrict a role to a minimal projection view
mongosh <<'EOF'
use admin
db.createRole({
  role: "readRestricted",
  privileges: [
    { resource: { db: "appdb", collection: "safe_view" }, actions: [ "find" ] }
  ],
  roles: []
})
EOF