{"schema":"threatline.record/2","record":{"id":"CVE-2026-103965","aliases":[],"summary":"Fixed values in MongoDB Server $bucket stage may be misread as field references","details":"An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.","categories":["Databases"],"product":"MongoDB Server","vendor":"MongoDB","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103965","source_modified_at":"2026-10-13T16:20:06.145Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"MongoDB Server","vendor":"MongoDB","versions":[{"status":"affected","version":"8.3.0","lessThan":"8.3.13","versionType":"semver"},{"status":"affected","version":"8.0","lessThan":"8.0.34","versionType":"semver"},{"status":"affected","version":"7.0","lessThan":"7.0.45","versionType":"semver"},{"status":"affected","version":"9.0","lessThan":"9.0.4","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103965","source_modified_at":"2026-10-13T16:20:06.145Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"MongoDB Server","ecosystem":null},"version":"8.3.13","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103965","source_modified_at":"2026-10-13T16:20:06.145Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"MongoDB Server","ecosystem":null},"version":"8.0.34","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103965","source_modified_at":"2026-10-13T16:20:06.145Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"MongoDB Server","ecosystem":null},"version":"7.0.45","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103965","source_modified_at":"2026-10-13T16:20:06.145Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"MongoDB Server","ecosystem":null},"version":"9.0.4","basis":"first unaffected version stated in the CVE record"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0015,"percentile":0.03858,"score_date":"2026-10-23"},"published_at":"2026-10-13T15:33:20.112Z","modified_at":"2026-10-13T16:20:06.145Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103965","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T16:20:06.145Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103965","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://jira.mongodb.org/browse/SERVER-134618"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-13T15:46:32.315998Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-13T16:20:06.145Z","content_hash":"5e7a680080871015ab8ef980d8ebcc28f768dcf356e469858a7e9db76eeadf2d"}}