CVE-2026-126823

Received Received - Intake

JDBC Driver Code Execution via Local File Inclusion

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: MongoDB, Inc.

Description

A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing inside the application process, which may result in disclosure or alteration of data held by that process or in the process becoming unavailable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126823

Affected Vendors & Products

Vendor	Product	Version / Range
MongoDB	Atlas SQL JDBC Driver	From 2.2.1 (inc) to 4.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

Executive Summary

This vulnerability allows a local user with ordinary account privileges to place a malicious file in a shared temporary directory. The JDBC driver's native library loading routine will load this file without verifying its origin. When the driver class is loaded in a Java application, it can execute the user's chosen code within the application process, potentially leading to data disclosure, data alteration, or denial of service.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to compromise the confidentiality, integrity, or availability of data processed by the affected Java application. It may result in unauthorized data access, data corruption, or system unavailability, depending on the application's context and permissions.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR or HIPAA by enabling unauthorized access or modification of sensitive data. Organizations may face legal penalties, reputational damage, and increased scrutiny if such breaches occur due to inadequate security controls.

Mitigation Strategies

Update the MongoDB Atlas SQL JDBC Driver to the latest version that addresses this issue. Restrict write access to shared temporary directories where the JDBC driver loads native libraries. Monitor application logs for unexpected native library loading events.

Hi! I’m here to help you understand CVE-2026-126823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...