CVE-2026-103965— Fixed values in MongoDB Server $bucket stage may be misread as field references
Quick assessment
Affected
MongoDB MongoDB Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB 服务器的聚合框架中存在一个问题，可能导致在内部查询重写过程中某些常量值被错误处理。在特定条件下，具有读取权限的已认证用户可能在聚合输出中收到查询本不应返回的字段值。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | MongoDB Server | 8.3.0< 8.3.13 |
affected |
8.0< 8.0.34 |
affected | ||
7.0< 7.0.45 |
affected | ||
9.0< 9.0.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103965
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fixed values in MongoDB Server $bucket stage may be misread as field references
Source: CVE Program / CVE List V5
Vulnerability Description
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | MongoDB Server | 8.3.0 ~ 8.3.13 | - |
|
II. Public POCs for CVE-2026-103965
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103965
请登录查看更多情报信息。
Same Patch Batch · MongoDB · 2026-10-13 · 5 CVEs total
| CVE-2026-96297 | 6.5 MEDIUM | MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggr |
| CVE-2026-96299 | 6.5 MEDIUM | Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads t |
| CVE-2026-104005 | 6.5 MEDIUM | Incorrect authorization in MongoDB Server router for bulk writes to system namespaces |
| CVE-2026-104004 | 6.5 MEDIUM | Collection validators using collation-accepting expressions can crash MongoDB Server on in |
IV. Related Vulnerabilities
Same product: MongoDB Server
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-104004
Collection validators using collation-accepting expressions -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_ -
CVE-2026-89099
Race Condition in MongoDB Server Document Value Layer Leads
Same vendor: MongoDB
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-104004
Collection validators using collation-accepting expressions -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-96297
MongoDB Server may disclose process memory via a crafted `$_ -
CVE-2026-87109
Ops Manager Sensitive MFA Enrollment Information Exposure in
Same weakness: CWE-94
-
CVE-2026-110445
TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection -
CVE-2026-110444
TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection -
CVE-2026-92097
Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode -
CVE-2026-106624
ColdFusion | Improper Control of Generation of Code ('Code I -
CVE-2026-106621
ColdFusion | Improper Control of Generation of Code ('Code I
V. Comments for CVE-2026-103965
No comments yet