Vulnerability in MongoDB Atlas SQL JDBC Driver

[ Description ]Official description

A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4328

  MongoDB (EF Core Provider, Atlas SQL, C Treiber, Rust Treiber, Database Tools and Node.js Treiber): Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-119672CVE-2026-120954CVE-2026-120678+12 more CVEs

[ References ]References

• jira.mongodb.org/browse/SQL-3539
• www.mongodb.com/docs/sql-interface/changelog