Medium
mongodb — security advisory
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.
- Products
- mongodb
- Affected versions
- 1:2.4.6-0ubuntu5, 1:2.4.6-0ubuntu6, 1:2.4.8-1ubuntu1, 1:2.4.8-2, 1:2.4.9-1, 1:2.4.9-1ubuntu1, 1:2.4.9-1ubuntu2, 1:2.4.9-1ubuntu2+esm2, 1:2.6.10-0ubuntu1, 1:2.6.10-0ubuntu1+esm2, 1:3.4.14-3ubuntu1, 1:3.4.14-3ubuntu2, 1:3.4.7-1, 1:3.4.7-1ubuntu1, 1:3.4.7-1ubuntu2, 1:3.4.7-1ubuntu4, 1:3.6.3-0ubuntu1, 1:3.6.3-0ubuntu1.1, 1:3.6.3-0ubuntu1.3, 1:3.6.3-0ubuntu1.4, 1:3.6.3-0ubuntu1.4+esm1, 1:3.6.3-0ubuntu1.4+esm2, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-103965
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:58 UTC · Revision 1
Source evidence
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.
osv:UBUNTU-CVE-2026-103965
mongodb
Fixed versions: Not specified
mongodb
Fixed versions: Not specified
mongodb
Fixed versions: Not specified
mongodb
Fixed versions: Not specified
Complete source record
{
"id": "afe0429aedadcd80d7ff3b95f9777d6651f342c41ebcd7b017db2e83735c085c",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-103965",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-103965",
"summary": "An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.",
"evidence": "osv:UBUNTU-CVE-2026-103965",
"products": [
{
"name": {
"value": "mongodb",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:2.4.6-0ubuntu5",
"evidence": "/affected/0/versions"
},
{
"value": "1:2.4.6-0ubuntu6",
"evidence": "/affected/0/versions"
},
{
"value": "1:2.4.8-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1:2.4.8-2",
"evidence": "/affected/0/versions"
},
{
"value": "1:2.4.9-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:2.4.9-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1:2.4.9-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "1:2.4.9-1ubuntu2+esm2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "mongodb",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:2.6.10-0ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "1:2.6.10-0ubuntu1+esm2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "mongodb",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:3.4.7-1",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.4.7-1ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.4.7-1ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.4.7-1ubuntu4",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.4.14-3ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.4.14-3ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.6.3-0ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.6.3-0ubuntu1.1",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.6.3-0ubuntu1.3",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.6.3-0ubuntu1.4",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.6.3-0ubuntu1.4+esm1",
"evidence": "/affected/2/versions"
},
{
"value": "1:3.6.3-0ubuntu1.4+esm2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "mongodb",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2",
"evidence": "/affected/3/versions"
},
{
"value": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5",
"evidence": "/affected/3/versions"
},
{
"value": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2",
"evidence": "/affected/3/versions"
},
{
"value": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3",
"evidence": "/affected/3/versions"
},
{
"value": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-103965",
"aliases": [
"UBUNTU-CVE-2026-103965"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "mongodb",
"purl": "pkg:deb/ubuntu/mongodb?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"1:2.4.6-0ubuntu5",
"1:2.4.6-0ubuntu6",
"1:2.4.8-1ubuntu1",
"1:2.4.8-2",
"1:2.4.9-1",
"1:2.4.9-1ubuntu1",
"1:2.4.9-1ubuntu2",
"1:2.4.9-1ubuntu2+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103965.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mongodb",
"binary_version": "1:2.4.9-1ubuntu2+esm2"
},
{
"binary_name": "mongodb-clients",
"binary_version": "1:2.4.9-1ubuntu2+esm2"
},
{
"binary_name": "mongodb-server",
"binary_version": "1:2.4.9-1ubuntu2+esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "mongodb",
"purl": "pkg:deb/ubuntu/mongodb?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"1:2.6.10-0ubuntu1",
"1:2.6.10-0ubuntu1+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103965.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mongodb",
"binary_version": "1:2.6.10-0ubuntu1+esm2"
},
{
"binary_name": "mongodb-clients",
"binary_version": "1:2.6.10-0ubuntu1+esm2"
},
{
"binary_name": "mongodb-server",
"binary_version": "1:2.6.10-0ubuntu1+esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "mongodb",
"purl": "pkg:deb/ubuntu/mongodb?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"1:3.4.7-1",
"1:3.4.7-1ubuntu1",
"1:3.4.7-1ubuntu2",
"1:3.4.7-1ubuntu4",
"1:3.4.14-3ubuntu1",
"1:3.4.14-3ubuntu2",
"1:3.6.3-0ubuntu1",
"1:3.6.3-0ubuntu1.1",
"1:3.6.3-0ubuntu1.3",
"1:3.6.3-0ubuntu1.4",
"1:3.6.3-0ubuntu1.4+esm1",
"1:3.6.3-0ubuntu1.4+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103965.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mongodb",
"binary_version": "1:3.6.3-0ubuntu1.4+esm2"
},
{
"binary_name": "mongodb-clients",
"binary_version": "1:3.6.3-0ubuntu1.4+esm2"
},
{
"binary_name": "mongodb-server",
"binary_version": "1:3.6.3-0ubuntu1.4+esm2"
},
{
"binary_name": "mongodb-server-core",
"binary_version": "1:3.6.3-0ubuntu1.4+esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "mongodb",
"purl": "pkg:deb/ubuntu/mongodb?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2",
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5",
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2",
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3",
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103965.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mongodb",
"binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
},
{
"binary_name": "mongodb-clients",
"binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
},
{
"binary_name": "mongodb-server",
"binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
},
{
"binary_name": "mongodb-server-core",
"binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
}
]
}
}
],
"modified": "2026-10-17T12:57:58.387281522Z",
"provider": "osv",
"upstream": [
"CVE-2026-103965"
],
"references": [
"https://ubuntu.com/security/CVE-2026-103965",
"https://www.cve.org/CVERecord?id=CVE-2026-103965",
"https://jira.mongodb.org/browse/SERVER-134618"
]
},
"related_cves": [
{
"value": "CVE-2026-103965",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 357797,
"published_at": "2026-10-13T16:17:00+00:00"
}