{"id":"CVE-2026-126823","kind":"vulnerability","aliases":["CVE-2026-126823"],"related":[],"title":"MongoDB Atlas SQL JDBC driver loads a planted native library from a shared temp directory","description":"A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing inside the application process, which may result in disclosure or alteration of data held by that process or in the process becoming unavailable.","summary":"A JDBC driver loads a native library from a shared temporary directory without checking where the file came from. A local user with an ordinary account can place a file there, and when the Java application loads the driver class, that code runs inside the application process.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mongodb-jdbc","fixed":["4.0.2"],"affected":"< 4.0.2","ecosystem":"maven"}],"ecosystems":[],"tags":["atlas-sql","java","jdbc","mongodb","package","shared-hosts"],"not_affected_if":["driver-not-used","single-user-host"],"how_to_check":"Find the driver in your build: look for org.mongodb:mongodb-jdbc (class com.mongodb.jdbc.MongoDriver) in pom.xml, build.gradle, lock files or the app's lib folder (e.g. mvn dependency:tree, gradle dependencies). Any version below 4.0.2 should be treated as affected; MongoDB's changelog does not give the first affected version, so older 2.x/3.x are unconfirmed. Only matters on hosts where untrusted local users have accounts.","fix":"Upgrade the MongoDB Atlas SQL JDBC driver (Maven org.mongodb:mongodb-jdbc) to 4.0.2. Per MongoDB, the driver no longer accepts a library file that already exists in the shared temporary location.","status":"open","published_at":"2026-11-12T22:19:21+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","triaged_at":"2026-11-12T22:42:31+00:00","updated_at":"2026-11-12T22:43:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T22:42:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"JDBC driver: local user can plant native library and run code","impact":"high","summary":"A JDBC driver loads a native library from a shared temporary directory without checking where the file came from. A local user with an ordinary account can place a file there, and when the Java application loads the driver class, that code runs inside the application process.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","jdbc","shared-hosts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs inside the Java application process as the attacker","analyst_note":"Identify the affected JDBC driver package and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-126823.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-host","driver-not-used"],"who_is_affected":"Java applications that load the affected JDBC driver on a host where other local users have accounts, since the attack needs a local account on the same machine. The sources do not name the driver or the affected versions, so unknown beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4561,"output_tokens":438,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected JDBC driver package and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-126823.","search":"'-126823':18A,21A '-2026':17A,20A 'accept':112C 'account':60B,88C 'alter':146C 'applic':70B,80B,126C,138C 'atlas':2A,26B 'atlas-sql':25B 'becom':157C 'came':52B 'check':48B 'choos':135C 'class':74B,122C 'code':76B,130C 'cve':16A,19A 'data':148C 'directori':15A,46B 'disclosur':144C 'driver':5A,37B,73B,105C,121C 'file':51B,64B,96C 'held':149C 'host':34B,92C 'insid':78B,136C 'java':28B,69B,125C 'jdbc':4A,24A,29B,36B,104C 'librari':10A,41B,108C 'load':6A,38B,71B,109C,114C,119C 'local':55B,83C 'locat':101C 'may':127C,141C 'mongodb':1A,23A,30B 'mongodb-jdbc':22A 'nativ':9A,40B,107C 'ordinari':59B,87C 'origin':118C 'packag':31B 'place':62B,94C 'plant':8A 'process':81B,139C,152C,156C 'result':142C 'routin':110C 'run':77B,129C 'share':13A,33B,44B,99C 'shared-host':32B 'sql':3A,27B 'temp':14A 'temporari':45B,100C 'unavail':158C 'user':56B,84C,133C 'verifi':116C 'without':47B,115C","nicknames":[],"mitigations":[],"who_affected":"Java applications that load the MongoDB Atlas SQL JDBC driver (org.mongodb:mongodb-jdbc) on a host where other, untrusted local users have accounts; the attack needs a local account and a file placed in the shared temp location the driver uses for its native library. MongoDB says exploitation was unlikely because the library is loaded once at driver load and the temp location is not fixed and hard to predict. Single-user hosts, containers without other users, and apps not using this driver can skip it. The first affected version is not stated by the vendor.","tier":"B","verified":{"fix":{"at":"2026-11-12T22:43:43Z","by":"analyst","doc":"https://www.mongodb.com/docs/sql-interface/changelog/","run_id":3789}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mongodbjdbc"],"ptokens":["jdbc","mongodb"],"labels":["atlassql","high","java","jdbc","mongodb","package","sharedhosts"],"campaign_type":null,"search_a":"'-126823':18A,21A '-2026':17A,20A 'atlas':2A 'cve':16A,19A 'directori':15A 'driver':5A 'jdbc':4A,24A 'librari':10A 'load':6A 'mongodb':1A,23A 'mongodb-jdbc':22A 'nativ':9A 'plant':8A 'share':13A 'sql':3A 'temp':14A","search_b":"'account':60B 'applic':70B,80B 'atlas':26B 'atlas-sql':25B 'came':52B 'check':48B 'class':74B 'code':76B 'directori':46B 'driver':37B,73B 'file':51B,64B 'host':34B 'insid':78B 'java':28B,69B 'jdbc':29B,36B 'librari':41B 'load':38B,71B 'local':55B 'mongodb':30B 'nativ':40B 'ordinari':59B 'packag':31B 'place':62B 'process':81B 'run':77B 'share':33B,44B 'shared-host':32B 'sql':27B 'temporari':45B 'user':56B 'without':47B","search_c":"'accept':112C 'account':88C 'alter':146C 'applic':126C,138C 'becom':157C 'choos':135C 'class':122C 'code':130C 'data':148C 'disclosur':144C 'driver':105C,121C 'file':96C 'held':149C 'host':92C 'insid':136C 'java':125C 'jdbc':104C 'librari':108C 'load':109C,114C,119C 'local':83C 'locat':101C 'may':127C,141C 'nativ':107C 'ordinari':87C 'origin':118C 'place':94C 'process':139C,152C,156C 'result':142C 'routin':110C 'run':129C 'share':99C 'temporari':100C 'unavail':158C 'user':84C,133C 'verifi':116C 'without':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:19:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126823","severity":null,"published_at":"2026-11-12T22:19:21+00:00","modified_at":"2026-11-12T22:19:21+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","fetched_at":"2026-11-12T22:40:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126823:3789","url":"https://www.mongodb.com/docs/sql-interface/changelog/","severity":null,"published_at":"2026-11-12T22:43:43+00:00","modified_at":"2026-11-12T22:43:43+00:00","first_seen_at":"2026-11-12T22:43:43+00:00","fetched_at":"2026-11-12T22:43:43+00:00","note":"Vendor changelog (MongoDB SQL Interface, 2026-11-12) states JDBC 4.0.2 fixes CVE-2026-126823; no lower affected bound published; NVD/CVE.org pages empty so only vendor changelog read. No PoC or exploitation found; X skipped (credits). Severity unchanged.","cites":["https://www.mongodb.com/docs/sql-interface/changelog/","https://nvd.nist.gov/vuln/detail/CVE-2026-126823"]}],"documents":[{"id":140029,"url":"https://www.mongodb.com/docs/sql-interface/changelog/","title":"MongoDB SQL Interface Changelog (JDBC 4.0.2, CVE-2026-126823)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":140030,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126823","title":"NVD CVE-2026-126823","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}