Local File Insertion Vulnerability in JDBC Driver Affecting MongoDB
CVE-2026-126823

7.3HIGH

Key Information:

Vendor

Mongodb
Status
Atlas Sql Jdbc Driver
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126823?

A local user with standard privileges on the same host can exploit a vulnerability in the JDBC driver by placing a malicious file in a shared temporary location. When the JDBC driver's native library loading routine processes this file, it fails to verify its source, leading to execution of arbitrary code within the Java application. This can result in sensitive data being disclosed, altered, or the application becoming inoperable.

Affected Version(s)

Atlas SQL JDBC Driver 2.2.1 <= 4.0.1

References

https://jira.mongodb.org/browse/SQL-3540

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.