cyfenced.com →

[ CVE-2026-103965 · Published 13 Oct 2026 ]

Vulnerability in MongoDB Server

CVSS 5.4 EPSS <1%2 agency advisoriesFix available

[ Description ]Official description

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1304

    Multiple vulnerabilities in MongoDB Server Translated from French

    Multiple vulnerabilities have been discovered in MongoDB Server. They allow an attacker to cause remote arbitrary code execution and remote denial of service.

    CVE-2026-104004CVE-2026-96297CVE-2026-104005+2 more CVEs
  • BSI CERT-BundWID-SEC-2026-3924

    MongoDB: Multiple vulnerabilities Translated from German

    CVE-2026-96299CVE-2026-104004CVE-2026-103965+2 more CVEs

[ References ]References