---
id: "CVE-2026-126823"
page: "https://infrastack.ai/live/CVE-2026-126823"
kind: "vulnerability"
aliases: ["CVE-2026-126823"]
title: "MongoDB Atlas SQL JDBC driver loads a planted native library from a shared temp directory"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mongodb-jdbc", "fixed": ["4.0.2"], "affected": "< 4.0.2", "ecosystem": "maven"}]
ecosystems: []
tags: ["atlas-sql", "java", "jdbc", "mongodb", "package", "shared-hosts"]
not_affected_if: ["driver-not-used", "single-user-host"]
published_at: "2026-11-12T22:19:21+00:00"
first_seen_at: "2026-11-12T22:40:38+00:00"
updated_at: "2026-11-12T22:43:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126823", "first_seen_at": "2026-11-12T22:40:38+00:00"}, {"source": "analyst", "url": "https://www.mongodb.com/docs/sql-interface/changelog/", "first_seen_at": "2026-11-12T22:43:43+00:00", "cites": ["https://www.mongodb.com/docs/sql-interface/changelog/", "https://nvd.nist.gov/vuln/detail/CVE-2026-126823"]}]
exploit_sources: []
---

# MongoDB Atlas SQL JDBC driver loads a planted native library from a shared temp directory

Link for people: https://infrastack.ai/live/CVE-2026-126823 (this .md is for agents)

A JDBC driver loads a native library from a shared temporary directory without checking where the file came from. A local user with an ordinary account can place a file there, and when the Java application loads the driver class, that code runs inside the application process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:mongodb-jdbc affected < 4.0.2 fixed 4.0.2

## How to check

Find the driver in your build: look for org.mongodb:mongodb-jdbc (class com.mongodb.jdbc.MongoDriver) in pom.xml, build.gradle, lock files or the app's lib folder (e.g. mvn dependency:tree, gradle dependencies). Any version below 4.0.2 should be treated as affected; MongoDB's changelog does not give the first affected version, so older 2.x/3.x are unconfirmed. Only matters on hosts where untrusted local users have accounts.

## Fix

Upgrade the MongoDB Atlas SQL JDBC driver (Maven org.mongodb:mongodb-jdbc) to 4.0.2. Per MongoDB, the driver no longer accepts a library file that already exists in the shared temporary location.

## Timeline

- 2026-11-12T22:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126823
- 2026-11-12T22:43:43+00:00 analyst https://www.mongodb.com/docs/sql-interface/changelog/ — Vendor changelog (MongoDB SQL Interface, 2026-11-12) states JDBC 4.0.2 fixes CVE-2026-126823; no lower affected bound published; NVD/CVE.org pages empty so only vendor changelog read. No PoC or exploitation found; X skipped (credits). Severity unchanged.

## Documents

- [advisory] MongoDB SQL Interface Changelog (JDBC 4.0.2, CVE-2026-126823) https://www.mongodb.com/docs/sql-interface/changelog/
- [describes] NVD CVE-2026-126823 https://nvd.nist.gov/vuln/detail/CVE-2026-126823

## From the sources

A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing inside the application process, which may result in disclosure or alteration of data held by that process or in the process becoming unavailable.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_