CVE-2026-126823
Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dir
CVSS Score
7.0
EPSS Score
0.0%
EPSS Percentile
0th
A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing inside the application process, which may result in disclosure or alteration of data held by that process or in the process becoming unavailable.
| CWE | CWE-377 |
| Vendor | mongodb |
| Product | atlas sql jdbc driver |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb atlas sql jdbc driver
Be the first to know when new high vulnerabilities affecting mongodb atlas sql jdbc driver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
MongoDB / Atlas SQL JDBC Driver
2.2.1 ≤ 4.0.1