This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-103965 →

UBUNTU-CVE-2026-103965

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under...

Original description

The description as published by the source.

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:14.04:LTS mongodb

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:16.04:LTS mongodb

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:18.04:LTS mongodb

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:20.04:LTS mongodb

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report cve.org
report jira.mongodb.org