An issue in MongoDB Server's aggregation framework causes constant values to be treated as field references during internal query rewriting, particularly in the $bucket stage. Because the query is rewritten incorrectly, an authenticated reader can receive internal field values in the aggregation output that were not intended to be returned, resulting in accidental disclosure of data and classifying this flaw as a CWE‑94 information‑disclosure vulnerability.

The affected system is MongoDB Server distributed by MongoDB, Inc. The problem resides in the aggregation framework, specifically the $bucket stage. No explicit product version ranges are provided, so all deployments that include the vulnerable $bucket implementation may be impacted until a patch is applied.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability requires an authenticated user with read permissions to exploit it. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. Attackers would need to submit a crafted aggregation query through a normal client connection, so the attack vector is internal and dependent on valid credentials. Given the moderate CVSS and absence of high‑impact consequences, the risk is considered moderate, but remediation is recommended to prevent accidental data leakage.